Skip to content
OpenAdvisories

Archive

6 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /6 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-0674 Scanner template

    Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel

    Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the…

    Elber Signum DVB-S/S2 IRD Reble610 M/ODU XPIC IP-ASI-SDH Wayber Analog/Digital Audio STL
  • Critical 10.0
    CVE-2025-24786 Scanner template

    Path traversal opening Sqlite3 database in WhoDB

    WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database presen…

    clidey whodb github.com/clidey/whodb/core Go
  • Critical 9.3
    CVE-2025-24981

    Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

    MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `jav…

    nuxt-modules mdc @nuxtjs/mdc npm
  • Critical —
    GHSA-vrpv-vw92-328g

    Multiple rtmpdump vulnerabilities

    The version of rtmpdump contained in this package has multiple known vulnerabilities. ### Patches This package is abandoned and should not be used anymore. There is no patched release. ### Workarounds You should install rmtpdump from another source. ### Refer…

    rudloff/rtmpdump-bin Packagist
  • Critical 9.0
    CVE-2024-39272

    A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22…

    ClearML ClearML
  • Critical 9.4
    CVE-2023-5878

    OneWireless command injection possible when updating firmware

    Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potenti…

    Honeywell OneWireless Network Wireless Device Manager ICS / OT
  • Critical 9.4
    CVE-2025-0982

    Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)

    Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no l…

    Google Cloud Application Integration
  • Critical 9.8
    CVE-2024-51547

    Credentials Disclosure - keys

    Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.1
    CVE-2024-51450

    IBM Security Verify Directory Command Execution

    IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

    IBM Security Verify Directory
  • Critical 9.8
    CVE-2022-40916 Public exploit

    Tiny File Manager v2.4.7 and below is vulnerable to session fixation.

  • Critical 9.1
    CVE-2024-36556

    Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R…

  • Critical 9.8
    CVE-2024-36555

    Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h a…

  • Critical 9.8
    CVE-2024-36554

    Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R3…

  • Critical 9.8
    CVE-2024-57430 Public exploit

    An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attacker…

  • Critical 9.3
    CVE-2024-57428 Public exploit

    A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized in…

  • Critical 9.8
    CVE-2025-22992

    A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerabil…