[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 424268
> CVE-2025-21510 [HIGH 7.5]
[PUBLISHED: 2025-01-21] [EPSS 0.69%]
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards Enterprise...
AFFECTED_PRODUCTS: Oracle Jd Edwards Enterpriseone Tools
> CVE-2025-21509 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 0.69%]
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseO...
AFFECTED_PRODUCTS: Oracle Jd Edwards Enterpriseone Tools
> CVE-2025-21508 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 0.69%]
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseO...
AFFECTED_PRODUCTS: Oracle Jd Edwards Enterpriseone Tools
> CVE-2025-21507 [MEDIUM 5.4]
[PUBLISHED: 2025-01-21] [EPSS 0.19%]
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseO...
AFFECTED_PRODUCTS: Oracle Jd Edwards Enterpriseone Tools
> CVE-2025-21506 [HIGH 8.1]
[PUBLISHED: 2025-01-21] [EPSS 0.56%]
Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Fo...
AFFECTED_PRODUCTS: Oracle E-Business Suite
> CVE-2025-21505 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 1.07%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple prot...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21504 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 1.27%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to c...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21503 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 1.07%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise M...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21502 [MEDIUM 4.8]
[PUBLISHED: 2025-01-21] [EPSS 1.01%]
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Orac...
AFFECTED_PRODUCTS: Debian Debian Linux, Oracle Jre, Oracle Jre ... (+13)
> CVE-2025-21501 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 1.02%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to co...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21500 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 1.02%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to co...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21499 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 0.96%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server....
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21498 [MEDIUM 5.3]
[PUBLISHED: 2025-01-21] [EPSS 0.51%]
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks o...
AFFECTED_PRODUCTS: Oracle Http Server
> CVE-2025-21497 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.47%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise M...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21495 [MEDIUM 4.4]
[PUBLISHED: 2025-01-21] [EPSS 0.54%]
Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocol...
AFFECTED_PRODUCTS: Oracle Mysql Enterprise Firewall, Oracle Mysql Enterprise Firewall, Oracle Mysql Enterprise Firewall
> CVE-2025-21494 [MEDIUM 4.1]
[PUBLISHED: 2025-01-21] [EPSS 0.29%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure w...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21493 [MEDIUM 4.4]
[PUBLISHED: 2025-01-21] [EPSS 0.82%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compro...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21492 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 0.96%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Su...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21491 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 1.01%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise M...
AFFECTED_PRODUCTS: Oracle Mysql Server, Oracle Mysql Server, Oracle Mysql Server
> CVE-2025-21490 [MEDIUM 4.9]
[PUBLISHED: 2025-01-21] [EPSS 1.28%]
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise M...
AFFECTED_PRODUCTS: Debian Debian Linux, Oracle Mysql Server, Oracle Mysql Server ... (+1)
> CVE-2025-21489 [MEDIUM 6.1]
[PUBLISHED: 2025-01-21] [EPSS 0.20%]
Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions that are affected are 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advance...
AFFECTED_PRODUCTS: Oracle E-Business Suite
> CVE-2024-57545 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.44%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (hidden_dhcp_num) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57544 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.44%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (lan_ipaddr) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57543 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.44%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (dhcpstart_ip) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57542 [HIGH 8.8]
[PUBLISHED: 2025-01-21] [EPSS 1.82%]
Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57541 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.47%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (ipv6_protect_status) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57540 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 0.75%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57539 [HIGH 8.2]
[PUBLISHED: 2025-01-21] [EPSS 1.41%]
Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57538 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 0.75%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57537 [MEDIUM 6.3]
[PUBLISHED: 2025-01-21] [EPSS 0.45%]
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (page) is copied to the stack without length verification.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57536 [HIGH 8.0]
[PUBLISHED: 2025-01-21] [EPSS 1.51%]
Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status.
AFFECTED_PRODUCTS: Linksys E8450 Firmware
> CVE-2024-57360 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.25%]
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function.
> CVE-2024-55959 [CRITICAL 9.1]
[PUBLISHED: 2025-01-21] [EPSS 0.82%]
Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
> CVE-2024-55958 [MEDIUM 4.8]
[PUBLISHED: 2025-01-21] [EPSS 0.39%]
Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.
> CVE-2024-48392 [MEDIUM 5.4]
[PUBLISHED: 2025-01-21] [EPSS 0.81%]
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.
AFFECTED_PRODUCTS: Orangescrum Orangescrum
> CVE-2024-21245 [MEDIUM 5.4]
[PUBLISHED: 2025-01-21] [EPSS 0.19%]
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards En...
AFFECTED_PRODUCTS: Oracle Jd Edwards Enterpriseone Tools
> CVE-2025-24024 [CRITICAL 9.1]
[PUBLISHED: 2025-01-21] [EPSS 0.60%]
Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that i...
> CVE-2024-42936 [CRITICAL 9.8]
[PUBLISHED: 2025-01-21] [EPSS 1.07%]
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.
AFFECTED_PRODUCTS: Ruijie Reyee Os
> CVE-2023-45908 [MEDIUM 6.1]
[PUBLISHED: 2025-01-21] [EPSS 0.33%]
Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.
> CVE-2025-23369 [HIGH 8.8]
[PUBLISHED: 2025-01-21] [EPSS 1.62%]
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vul...
AFFECTED_PRODUCTS: GitHub Enterprise Server, GitHub Enterprise Server, GitHub Enterprise Server ... (+1)
> CVE-2024-55504 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.56%]
An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.
> CVE-2024-51417 [MEDIUM 6.4]
[PUBLISHED: 2025-01-21] [EPSS 0.33%]
An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.
> CVE-2025-24461 [MEDIUM 6.5]
[PUBLISHED: 2025-01-21] [EPSS 0.31%]
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
AFFECTED_PRODUCTS: Jetbrains TeamCity
> CVE-2025-24460 [MEDIUM 4.3]
[PUBLISHED: 2025-01-21] [EPSS 0.27%]
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
AFFECTED_PRODUCTS: Jetbrains TeamCity
> CVE-2025-24459 [MEDIUM 4.6]
[PUBLISHED: 2025-01-21] [EPSS 2.84%]
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
AFFECTED_PRODUCTS: Jetbrains TeamCity
> CVE-2025-24458 [HIGH 7.1]
[PUBLISHED: 2025-01-21] [EPSS 0.22%]
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
AFFECTED_PRODUCTS: Jetbrains Youtrack
> CVE-2025-24457 [MEDIUM 5.5]
[PUBLISHED: 2025-01-21] [EPSS 0.60%]
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
AFFECTED_PRODUCTS: Jetbrains Youtrack
> CVE-2025-24456 [MEDIUM 6.7]
[PUBLISHED: 2025-01-21] [EPSS 0.29%]
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
AFFECTED_PRODUCTS: Jetbrains Hub
> CVE-2025-24020 [MEDIUM 6.1]
[PUBLISHED: 2025-01-21] [EPSS 0.33%]
WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arb...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-24019 [HIGH 7.1]
[PUBLISHED: 2025-01-21] [EPSS 0.59%]
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. T...
AFFECTED_PRODUCTS: Yeswiki Yeswiki