Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2025

219 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2024-13160
    87Now

    Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote

    HighCVSS 7.5KEVWeaponizedEPSS 91%

    ivanti · endpoint managerJan 14, 2025

  • CVE-2024-13161
    87Now

    Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote

    HighCVSS 7.5KEVWeaponizedEPSS 90%

    ivanti · endpoint managerJan 14, 2025

  • CVE-2024-13162
    47Plan

    SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authentic

    HighCVSS 7.2No exploitEPSS 64%

    ivanti · endpoint managerJan 14, 2025

  • CVE-2024-13171
    36Monitor

    Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows

    HighCVSS 7.8No exploitEPSS 17%

    ivanti · endpoint managerJan 14, 2025

  • CVE-2025-21277
    42Plan

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 38%

    microsoft · windows 10 1507Jan 14, 2025

  • CVE-2025-21285
    47Plan

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 55%

    microsoft · windows 10 1507Jan 14, 2025

  • CVE-2025-21293
    41Plan

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 8.8WeaponizedEPSS 21%

    microsoft · windows 10 1507Jan 14, 2025

  • CVE-2025-21298
    63This week

    Windows OLE Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    microsoft · windows 10 1507Jan 14, 2025

  • CVE-2025-21309
    36Monitor

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 14%

    microsoft · windows server 2012Jan 14, 2025

  • CVE-2025-21333
    64This week

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    microsoft · windows 10 21h2Jan 14, 2025

  • CVE-2025-21334
    61This week

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 21h2Jan 14, 2025

  • CVE-2025-21335
    61This week

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 21h2Jan 14, 2025

  • CVE-2025-21340
    22Monitor

    Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 0%

    microsoft · windows 10 1809Jan 14, 2025

  • CVE-2024-49375
    36Monitor

    Remote Code Execution via Remote Model Loading in Rasa

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    rasahq · rasa-pro-security-advisoriesJan 14, 2025

  • CVE-2024-12085
    33Monitor

    Rsync: info leak via uninitialized stack contents

    HighCVSS 7.5Proof of conceptEPSS 8%

    samba · rsyncJan 14, 2025

  • CVE-2024-48760
    60This week

    An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.

    CriticalCVSS 9.8WeaponizedEPSS 45%

    gestioip · gestioipJan 14, 2025

  • CVE-2024-50857
    19Monitor

    The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS).

    MediumCVSS 4.8Proof of conceptEPSS 1%

    gestioip · gestioipJan 14, 2025

  • CVE-2024-50858
    36Monitor

    Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF).

    HighCVSS 8.8Proof of conceptEPSS 1%

    gestioip · gestioipJan 14, 2025

  • CVE-2024-50859
    19Monitor

    The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    gestioip · gestioipJan 14, 2025

  • CVE-2024-50861
    24Monitor

    The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    gestioip · gestioipJan 14, 2025

  • CVE-2024-47605
    21Monitor

    Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

    MediumCVSS 5.4Proof of conceptEPSS 1%

    silverstripe · silverstripe-asset-adminJan 14, 2025

  • CVE-2025-23061
    41Plan

    Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    mongoosejs · mongooseJan 15, 2025

  • CVE-2024-11848
    32Monitor

    NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    HighCVSS 8.1Proof of conceptEPSS 0%

    nitropack · nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimizationJan 15, 2025

  • CVE-2024-12084
    61This week

    Rsync: heap buffer overflow in rsync due to improper checksum length handling

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    samba · rsyncJan 15, 2025

  • CVE-2024-47002
    26Monitor

    A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528.

    MediumCVSS 5.4No exploitEPSS 15%

    observium · observiumJan 15, 2025

  • CVE-2025-22785
    38Monitor

    WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    commotion · course booking systemJan 15, 2025

  • CVE-2025-22968
    40Plan

    An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    dlink · dwr-m972v firmwareJan 15, 2025

  • CVE-2024-52005
    30Monitor

    The sideband payload is passed unfiltered to the terminal in git

    HighCVSS 7.5Proof of conceptEPSS 0%

    git · gitJan 15, 2025

  • CVE-2025-23040
    26Monitor

    Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop

    MediumCVSS 6.6Proof of conceptEPSS 0%

    desktop · desktopJan 15, 2025

  • CVE-2024-41453
    19Monitor

    A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or H

    MediumCVSS 4.8Proof of conceptEPSS 0%

    Jan 15, 2025

  • CVE-2024-53407
    13Monitor

    In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote cont

    LowCVSS 3.3Proof of conceptEPSS 0%

    phiewer · phiewerJan 15, 2025

  • CVE-2024-55503
    13Monitor

    An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES compo

    LowCVSS 3.3Proof of conceptEPSS 0%

    termius · termiusJan 15, 2025

  • CVE-2024-57726
    89Now

    SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce

    CriticalCVSS 9.9KEVWeaponizedEPSS 66%

    simple-help · simplehelpJan 15, 2025

  • CVE-2024-57727
    89Now

    SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re

    HighCVSS 7.5KEVWeaponizedEPSS 96%

    simple-help · simplehelpJan 15, 2025

  • CVE-2024-57728
    77This week

    SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a

    HighCVSS 7.2KEVWeaponizedEPSS 64%

    simple-help · simplehelpJan 15, 2025

  • CVE-2025-22964
    32Monitor

    DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inp

    HighCVSS 8.1Proof of conceptEPSS 0%

    ddsn · cm3 acora content management systemJan 15, 2025

  • CVE-2025-22912
    40Plan

    RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    edimax · re11s firmwareJan 15, 2025

  • CVE-2024-50633
    30Monitor

    A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted P

    HighCVSS 7.5Proof of conceptEPSS 0%

    cern · indicoJan 16, 2025

  • CVE-2024-57684
    43Plan

    An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the D

    CriticalCVSS 9.8No exploitEPSS 14%

    dlink · dir-816 firmwareJan 16, 2025

  • CVE-2025-23922
    40Plan

    WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    harsh · ispring embedderJan 16, 2025

  • CVE-2024-55511
    31Monitor

    A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jan 16, 2025

  • CVE-2024-57784
    22Monitor

    An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    Jan 16, 2025

  • CVE-2024-57785
    19Monitor

    Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.

    MediumCVSS 4.9Proof of conceptEPSS 0%

    Jan 16, 2025

  • CVE-2025-23200
    30Monitor

    Stored XSS-LibreNMS-Misc Section in librenms

    MediumCVSS 5.4No exploitEPSS 30%

    librenms · librenmsJan 16, 2025

  • CVE-2024-50967
    27Monitor

    The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    Jan 17, 2025

  • CVE-2018-9375
    31Monitor

    In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confus

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidJan 17, 2025

  • CVE-2023-50739
    35Monitor

    A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.

    HighCVSS 8.8No exploitEPSS 0%

    lexmark · printer firmwareJan 17, 2025

  • CVE-2025-23209
    69This week

    Potential RCE with a compromised security key in craft/cms

    HighCVSS 8.1KEVWeaponizedEPSS 21%

    craftcms · craft cmsJan 17, 2025

  • CVE-2024-13184
    30Monitor

    The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module

    HighCVSS 7.5Proof of conceptEPSS 0%

    wpextended · the ultimate wordpress toolkit – wp extendedJan 18, 2025

  • CVE-2024-13176
    16Monitor

    Timing side-channel in ECDSA signature computation

    MediumCVSS 4.1Proof of conceptEPSS 0%

    openssl · opensslJan 20, 2025

  • CVE-2025-22131
    20Monitor

    Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

    MediumCVSS 5.1Proof of conceptEPSS 0%

    phpoffice · phpspreadsheetJan 20, 2025

  • CVE-2025-22620
    20Monitor

    gix-worktree-state nonexclusive checkout sets executable files world-writable

    MediumCVSS 5.0Proof of conceptEPSS 0%

    gitoxidelabs · gitoxideJan 20, 2025

  • CVE-2024-49699
    35Monitor

    WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    reputeinfosystems · arpriceJan 21, 2025

  • CVE-2024-51818
    42Plan

    WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    radykal · fancy product designerJan 21, 2025

  • CVE-2025-22710
    30Monitor

    WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    storeapps · smart managerJan 21, 2025

  • CVE-2025-24001
    28Monitor

    WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    ngô thắng it · ppo call to actionsJan 21, 2025

  • CVE-2025-24011
    21Monitor

    Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

    MediumCVSS 5.3Proof of conceptEPSS 1%

    umbraco · umbraco cmsJan 21, 2025

  • CVE-2024-54794
    40Plan

    The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

    CriticalCVSS 9.1No exploitEPSS 12%

    eng · spagobiJan 21, 2025

  • CVE-2024-55504
    22Monitor

    An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote co

    MediumCVSS 5.5Proof of conceptEPSS 0%

    Jan 21, 2025

  • CVE-2025-23369
    30Monitor

    Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

    HighCVSS 7.6Proof of conceptEPSS 1%

    github · enterprise serverJan 21, 2025

  • CVE-2024-48392
    21Monitor

    OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 5.4Proof of conceptEPSS 0%

    orangescrum · orangescrumJan 21, 2025

  • CVE-2024-24451
    30Monitor

    A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jan 21, 2025

  • CVE-2024-13496
    31Monitor

    GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter

    HighCVSS 7.5Proof of conceptEPSS 2%

    gamipress · gamipressJan 22, 2025

  • CVE-2025-23942
    37Monitor

    WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    ngocuct0912 · wp load galleryJan 22, 2025

  • CVE-2024-31903
    35Monitor

    IBM Sterling B2B Integrator Standard Edition code execution

    HighCVSS 8.8Proof of conceptEPSS 0%

    ibm · sterling b2b integratorJan 22, 2025

  • CVE-2024-56924
    29Monitor

    A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J

    HighCVSS 7.3Proof of conceptEPSS 0%

    codeastro · internet banking systemJan 22, 2025

  • CVE-2025-23006
    76This week

    Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and

    CriticalCVSS 9.8KEVWeaponizedEPSS 23%

    sonicwall · sma8200vJan 23, 2025

  • CVE-2024-55192
    39Monitor

    OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char cons

    CriticalCVSS 9.8No exploitEPSS 0%

    openimageio · openimageioJan 23, 2025

  • CVE-2025-24582
    21Monitor

    WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 0%

    aa web servant · 12 step meeting listJan 24, 2025

  • CVE-2025-24587
    40Plan

    WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability

    HighCVSS 7.6Proof of conceptEPSS 32%

    nks · email subscription popupJan 24, 2025

  • CVE-2025-24659
    30Monitor

    WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    shahjada · wpdm – premium packagesJan 24, 2025

  • CVE-2024-57041
    30Monitor

    A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' se

    MediumCVSS 4.6No exploitEPSS 39%

    nodebb · nodebbJan 24, 2025

  • CVE-2025-0411
    78This week

    7-Zip Mark-of-the-Web Bypass Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 67%

    7-zip · 7-zipJan 25, 2025

  • CVE-2024-13055
    28Monitor

    Dyn Business Panel <= 1.0.0 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    phycticio · dyn business panelJan 27, 2025

  • CVE-2024-13094
    28Monitor

    WP Triggers Lite <= 2.5.3 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    wptriggers · wp triggers liteJan 27, 2025

  • CVE-2024-52012
    34Monitor

    Apache Solr: Configset upload on Windows allows arbitrary path write-access

    MediumCVSS 5.4No exploitEPSS 44%

    apache · solrJan 27, 2025

  • CVE-2024-54146
    49Plan

    Cacti has a SQL Injection vulnerability when view host template

    HighCVSS 8.8No exploitEPSS 46%

    cacti · cactiJan 27, 2025

  • CVE-2025-22604
    30Monitor

    Cacti has Authenticated RCE via multi-line SNMP responses

    HighCVSS 7.2Proof of conceptEPSS 5%

    cacti · cactiJan 27, 2025

  • CVE-2025-24354
    21Monitor

    imgproxy is vulnerable to SSRF against 0.0.0.0

    MediumCVSS 5.3Proof of conceptEPSS 0%

    imgproxy · imgproxyJan 27, 2025

  • CVE-2025-24367
    50Plan

    Cacti allows Arbitrary File Creation leading to RCE

    HighCVSS 8.7WeaponizedEPSS 54%

    cacti · cactiJan 27, 2025

  • CVE-2024-48841
    41Plan

    Remote Code Execution (RCE) Vulnerabilities

    CriticalCVSS 10.0Proof of conceptEPSS 4%

    abb · flxeonJan 27, 2025

  • CVE-2024-54507
    22Monitor

    A type confusion issue was addressed with improved memory handling.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · ipadosJan 27, 2025

  • CVE-2025-24085
    75This week

    A use after free issue was addressed with improved memory management.

    CriticalCVSS 10.0KEVWeaponizedEPSS 17%

    apple · ipadosJan 27, 2025

  • CVE-2025-24104
    22Monitor

    This issue was addressed with improved handling of symlinks.

    MediumCVSS 5.5Proof of conceptEPSS 1%

    apple · ipadosJan 27, 2025

  • CVE-2025-24118
    29Monitor

    The issue was addressed with improved memory handling.

    HighCVSS 7.1Proof of conceptEPSS 3%

    apple · ipadosJan 27, 2025

  • CVE-2024-57373
    32Monitor

    Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of

    HighCVSS 8.1Proof of conceptEPSS 0%

    Jan 27, 2025

  • CVE-2022-31749
    26Monitor

    Authenticated arbitrary file read/write in WatchGuard Fireware OS

    MediumCVSS 6.5Proof of conceptEPSS 1%

    watchguard · fireware osJan 27, 2025

  • CVE-2022-3365
    60This week

    Emote Interactive Remote Mouse Server command injection due to weak encoding

    CriticalCVSS 9.8WeaponizedEPSS 2%

    emote interactive · remote mouse serverJan 27, 2025

  • CVE-2024-11954
    20Monitor

    Pimcore Search Document cross site scripting

    MediumCVSS 5.1Proof of conceptEPSS 1%

    pimcore · pimcoreJan 28, 2025

  • CVE-2024-11956
    20Monitor

    Pimcore customer-data-framework list sql injection

    MediumCVSS 5.1Proof of conceptEPSS 0%

    pimcore · pimcoreJan 28, 2025

  • CVE-2025-23211
    40Plan

    Tandoor Recipes - SSTI - Remote Code Execution

    CriticalCVSS 9.9Proof of conceptEPSS 3%

    tandoor · recipesJan 28, 2025

  • CVE-2024-40676
    30Monitor

    In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a

    HighCVSS 7.7Proof of conceptEPSS 0%

    google · androidJan 28, 2025

  • CVE-2024-55968
    35Monitor

    An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.

    HighCVSS 8.8Proof of conceptEPSS 1%

    Jan 28, 2025

  • CVE-2024-57376
    36Monitor

    Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthentica

    HighCVSS 8.8Proof of conceptEPSS 3%

    dlink · dsr-150 firmwareJan 28, 2025

  • CVE-2024-57514
    19Monitor

    The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web

    MediumCVSS 4.8Proof of conceptEPSS 0%

    Jan 28, 2025

  • CVE-2024-12749
    28Monitor

    Competition Form <= 2.0 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    raiserweb · competition formJan 29, 2025

  • CVE-2024-48849
    35Monitor

    Authentication and Authorization Issues

    HighCVSS 8.8Proof of conceptEPSS 0%

    abb · flxeonJan 29, 2025

  • CVE-2024-48852
    28Monitor

    Information disclosures

    MediumCVSS 6.9Proof of conceptEPSS 2%

    abb · flxeonJan 29, 2025

  • CVE-2024-11187
    35Monitor

    Many records in the additional section cause CPU exhaustion

    HighCVSS 7.5No exploitEPSS 15%

    isc · bind 9Jan 29, 2025

  • CVE-2024-12705
    36Monitor

    DNS-over-HTTPS implementation suffers from multiple issues under heavy query load

    HighCVSS 7.5No exploitEPSS 18%

    isc · bind 9Jan 29, 2025