CIRCL/vulnerability-scores huggingface dataset:
GHSA-4hwx-98xh-r7rc 
Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability."
RHSA-2003:214 Red Hat Security Advisory: : : : Updated tcpdump packages fix various vulnerabilities
security flaw security flaw security flaw security flaw security flaw security flaw
GHSA-824c-mgf3-2q6m 
Stack-based buffer overflow in Dassault Systemes CATIA V5-6R2013 allows remote attackers to execute arbitrary code via a crafted packet, related to "CATV5_Backbone_Bus."
CVSS v3.1 score: 9.8
CVE-2023-39941 
Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1 score: 7.1
CVE-2012-3868 
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
CVSS v2.0 score: 4.3
CVE-2022-4512 Better Font Awesome < 2.0.4 - Contributor+ Stored XSS
The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1 score: 6.8
CVE-2015-4617 
Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-3qg9-j2gc-w8g9 
In the Linux kernel, the following vulnerability has been resolved:io_uring/zcrx: fix page array leakd9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed
a page leakage but didn't free the page array, release it as well.
GHSA-54vr-v43g-gq47 
In the Linux kernel, the following vulnerability has been resolved:RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()The ucmd->log_sq_bb_count variable is controlled by the user so this
shift can wrap.  Fix it by using check_shl_overflow() in the same way
that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
behavior in hns_roce_set_user_sq_size()").
CVSS v3.1 score: 7.8
GHSA-vm7c-g967-fj52 
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1 score: 4.8
GHSA-cw2q-7r7v-77r7 
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php.  NOTE: vector 1 requires user authentication.
CVE-2010-1491 
Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
CVSS v2.0 score: 5
GHSA-xxcx-v673-pwpr 
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs.  Software customers upgrade to resolved maintenance release.  Update Command Center.
CVSS v4.0 score: 8.8
GHSA-8hrw-qmjc-qr28 
Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/addWifiMacFilter.
CVSS v3.1 score: 9.8
GHSA-2pp6-ppvw-38pj 
Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 8.8
CVE-2010-2691 
Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via the (1) sbid parameter to products_details.php, (2) pid parameter to products/products.php, and (3) designid parameter to designview.php.
CVSS v2.0 score: 7.5
CVE-2023-45584 
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
CVSS v3.1 score: 6.3
GHSA-5p9v-rcw6-x249 
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
CVSS v3.1 score: 7.2
GHSA-hp87-jr7m-7m74 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
GHSA-ffm3-7v29-m7x8 
The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.
CVSS v3.0 score: 8.8
CVE-2023-29930 
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
CVSS v3.1 score: 8.8
CVE-2007-4159 
index.html in the HTTP administration interface in certain daemons in TIBCO Rendezvous (RV) 7.5.2 allows remote attackers to obtain sensitive information, such as a user name and IP addresses, via a direct request.
CVSS v2.0 score: 5
GHSA-qgqr-m83v-6vh4 
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive.
CVSS v3.1 score: 7.5
RHSA-2026:54185 Red Hat Security Advisory: firefox security update
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component firefox: thunderbird: Site isolation issue in the DOM: Navigation component firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component firefox: thunderbird: Information disclosure in the Graphics: ImageLib component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: thunderbird: Incorrect boundary conditions in the Graphics component firefox: thunderbird: Site isolation issue in the Graphics: WebRender component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component firefox: thunderbird: Privilege escalation in the DOM: Navigation component firefox: thunderbird: Information disclosure in the Framework component in DevTools firefox: thunderbird: Site isolation issue in the Networking: HTTP component firefox: thunderbird: Mitigation bypass in the PDF Viewer component firefox: thunderbird: Privilege escalation in the DOM: Content Processes component firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component firefox: thunderbird: Mitigation bypass in the DOM: Networking component firefox: thunderbird: Site isolation issue in the Networking component firefox: thunderbird: Mitigation bypass in the Enterprise Policies component firefox: thunderbird: Information disclosure in the Storage: IndexedDB component firefox: thunderbird: Privilege escalation in WebExtensions firefox: thunderbird: Information disclosure in the Networking: WebSockets component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode
CVSS v3.1 score: 7.6
CVE-2014-1480 
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
CVSS v2.0 score: 4.3
CVE-2016-8311 
Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 6.5 (Confidentiality impacts).
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
RHSA-2016:0711 Red Hat Security Advisory: jenkins security update
jenkins: Remote code execution vulnerability in remoting module (SECURITY-232) jenkins: HTTP response splitting vulnerability (SECURITY-238) jenkins: Non-constant time comparison of API token (SECURITY-241) jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245) jenkins: Remote code execution through remote API (SECURITY-247)
CVE-2024-3844 
Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS v3.1 score: 4.3
GHSA-gr7w-wf2v-m7qv 
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block.
CVSS v3.1 score: 5.3
PYSEC-2024-107 
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 5
CVE-2024-30222 WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
CVSS v3.1 score: 8.5
CVE-2026-72346 platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
In the Linux kernel, the following vulnerability has been resolved:

platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

The driver registers two distinct WMI devices: a control device
(BITLAND_WMI_CONTROL) and an event device (BITLAND_WMI_EVENT). During
the probe phase, the event device handling path returns early before
initializing the platform profile device (data->pp_dev), leaving it
NULL.

However, the PM sleep operations are registered globally for the WMI
driver and are triggered for both devices. When entering suspend, the
event device invokes bitland_mifs_wmi_suspend(), which passes the
uninitialized data->pp_dev (NULL) into laptop_profile_get(). This leads
to a NULL pointer dereference inside dev_get_drvdata(), causing a
kernel Oops and halting the suspend sequence.

Fix this by adding a validity check for data->pp_dev in both the suspend
and resume callbacks, safely skipping profile operations for the event
device.
GHSA-r2gc-pmgg-qcmf 
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain access via a TELNET session.
GHSA-gq65-g7pm-37m5 
dropboxd in Dropbox 0.7.110 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVE-2017-7982 
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
GHSA-xqmw-24v9-r296 
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
CVSS v3.1 score: 7.1
GHSA-wq3v-p2w9-j7mf 
Memory corruption while parsing clock configuration data for a specific hardware type.
CVSS v3.1 score: 6.7
CVE-2013-3460 
Memory leak in Cisco Unified Communications Manager (Unified CM) 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(1) allows remote attackers to cause a denial of service (service disruption) via a high rate of UDP packets, aka Bug ID CSCub85597.
CVSS v2.0 score: 7.8
GHSA-g8p4-j6g7-gq3v 
Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.
GHSA-qh5m-qm4j-4q2w 
Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected.
GHSA-7mv3-85q3-4cg5 
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
CVSS v3.0 score: 5.5
CVE-2025-12289 Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting
A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unknown functionality of the file /Point/index/activity_state/1/category_id/1001. Executing manipulation of the argument category_id can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 5
CVE-2022-1485 
Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 7.5
GHSA-hc93-8cwc-v5c6 
Multiple stack-based buffer overflows in (a) acon.c, (b) menu.c, and (c) child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via (1) a long HOME environment variable or (2) a large number of terminal columns.
CVE-2018-3917 
On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The strcpy call overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long "region" value in order to exploit this vulnerability.
CVSS v3.0 score: 7.5
RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
jackson-mapper-asl: XML external entity similar to CVE-2016-3720 cxf: OpenId Connect token service does not properly validate the clientId cxf: reflected XSS in the services listing page Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader Soteria: security identity corruption across concurrent threads undertow: AJP File Read/Inclusion Vulnerability undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass cryptacular: excessive memory allocation during a decode operation undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header undertow: invalid HTTP request with large chunk size
CVSS v3.1 score: 6.5
CVSS v3.0 score: 8.1
CVE-2014-4027 
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
CVSS v2.0 score: 2.3
RHSA-2024:11237 Red Hat Security Advisory: libsndfile:1.0.31 security update
libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote()
CVSS v3.1 score: 5.5
CVE-2019-4549 
IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165951.
CVSS v3.0 score: 5.3
CVE-2025-55199 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
CVSS v3.1 score: 6.5
CVE-2010-0068 
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP2, and 10.0 allows remote attackers to affect confidentiality via unknown vectors.
CVSS v2.0 score: 5
CVE-2016-2292 
Stack-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-2x5f-p62m-48r4 
A vulnerability classified as problematic was found in SourceCodester Accounts Manager App 1.0. This vulnerability affects unknown code of the file update-account.php of the component Update Account Page. The manipulation of the argument Account Name/Username/Password/Link leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 3.5
CVE-2024-0481 Taokeyun HTTP POST Request Goods.php shopGoods sql injection
A vulnerability was found in Taokeyun up to 1.0.5. It has been rated as critical. Affected by this issue is the function shopGoods of the file application/index/controller/app/store/Goods.php of the component HTTP POST Request Handler. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250586 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-p6cv-q8p6-3vx5 
ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands.
CVE-2019-1647 Cisco SD-WAN Solution Unauthorized Access Vulnerability
A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to other vSmart containers. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
CVSS v3.0 score: 8
GHSA-46rr-74pw-3rhx 
RemoteDocs R-Viewer before 1.6.3768 stores encrypted RDZ file data in unencrypted temporary files, which allows local users to obtain sensitive information by reading the temporary files.
GHSA-xh3c-fg2p-f6rr 
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
CVSS v3.1 score: 7.5
CVE-2005-3143 
Unspecified vulnerability in the Mailbox Server for 4D WebStar before 5.3.5 allows attackers to cause a denial of service (crash) via IMAP clients on Mac OS X 10.4 Mail 2.
CVSS v2.0 score: 5
RHSA-2024:0223 Red Hat Security Advisory: java-1.8.0-openjdk security and bug fix update
OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) OpenJDK: range check loop optimization issue (8314307) OpenJDK: arbitrary Java code execution in Nashorn (8314284) OpenJDK: logging of digital signature private keys (8316976) OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547)
CVSS v3.1 score: 7.4
CVE-2018-6893 
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-jc9w-4vh5-cjvm 
Memory leak in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2, allows remote attackers to cause a denial of service (memory consumption) by performing a large number of RSA cryptographic operations.
CVE-2007-5856 
Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive information.
CVSS v2.0 score: 9.4
GHSA-cx69-6c4v-7rhc 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3.
CVSS v3.1 score: 6.5
CVE-2019-11180 
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
PYSEC-2026-366 
The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their `Content-Security-Policy`. 

Combined with `nbconvert.HTMLExporter`'s default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.

### Impact

An authenticated victim who navigates to `/nbconvert/html/<path>` containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.

### Patches

Fixed in v2.20.0, commit [6cbee8d](https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd)
 

### Workarounds

For deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:

```
import jupyter_server.nbconvert.handlers as _nb

def _csp(self):
    return super(type(self), self).content_security_policy + "; sandbox allow-scripts"

_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)
```
CVSS v4.0 score: 9.3
CVE-2022-2251 
Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that other user.
CVSS v3.1 score: 4.8
CVE-2018-0470 Cisco IOS XE Software HTTP Denial of Service Vulnerability
A vulnerability in the web framework of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to the affected software improperly parsing malformed HTTP packets that are destined to a device. An attacker could exploit this vulnerability by sending a malformed HTTP packet to an affected device for processing. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected device, resulting in a DoS condition.
CVSS v3.0 score: 8.6
CVSS v2.0 score: 7.8
CVE-2025-1302 
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.**Note:**This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-gx64-5mxv-c598 
HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly restrict certain operation in certain scenario, the attacker should do certain configuration before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function. Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8).
CVE-2017-10603 Junos OS: Local XML Injection through CLI command can lead to privilege escalation
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue.
CVSS v3.0 score: 7
GHSA-4mx6-fjqc-4rhr 
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS v3.0 score: 9.8
CVE-2025-54989 Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability
Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.
CVSS v3.1 score: 5.3
CVE-2021-20308 
Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2018-10810 
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-c75m-mxjw-cwc6 
Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.
CVSS v3.0 score: 5.5
GHSA-94q3-q8mx-4q6c 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.
CVSS v3.1 score: 6.5
GHSA-h769-2vfr-4wxg 
An unauthenticated attacker can obtain other users' charger information.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-g46m-gc36-5vjh 
A vulnerability classified as problematic has been found in RSJoomla RSFirewall Plugin. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214038 is the identifier assigned to this vulnerability.
CVE-2013-3625 
An unspecified DLL file in Baramundi Management Suite 7.5 through 8.9 uses a hardcoded encryption key, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.
CVSS v2.0 score: 7.8
GHSA-4jh5-9c29-9299 
Multiple SQL injection vulnerabilities in iGaming 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the browse parameter to (1) previews.php and (2) reviews.php, and the (3) id parameter to index.php in a viewarticle action.
GHSA-6v36-wr64-x57x 
Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
GHSA-rv6f-qvmh-mjmm 
A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands.
CVSS v3.0 score: 9.8
GHSA-9q47-75mf-qmf9 
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field.
CVE-2021-31562 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly secured by SSL/TLS, and impersonate an entity to gain access to sensitive information.
CVSS v3.1 score: 6.5
CVE-2017-6042 
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-wqhx-32c6-gg95 
A denial of service vulnerability in the Android media framework (libmediaplayerservice). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38391487.
CVSS v3.0 score: 5.5
GHSA-cjw9-ghj4-fwxf fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
⚠️ IMPORTANT CLARIFICATIONSAffected ConfigurationsThis vulnerability ONLY affects applications that:Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce optionsConfigure patterns susceptible to catastrophic backtrackingExample: `allowedAud: /^(a+)+X$/` ← VULNERABLEExample: `allowedAud: "api.company.com"` ← SAFENot AffectedApplications using string patterns for audience validation (most common)Applications using safe RegExp patterns without nested quantifiersDefault fast-jwt configurationsAssessment GuideTo determine if you're affected:Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`)If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc.If no RegExp usage, you are NOT affected
CVSS v3.1 score: 4.2
CVE-2013-0264 
An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-x8fg-5cvf-qg6q 
Cross-Site Request Forgery (CSRF) vulnerability in Nilesh Shiragave WordPress Gallery Plugin allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin: from n/a through 1.4.
CVSS v3.1 score: 7.1
GHSA-g3r8-r8px-gp93 
Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.
GHSA-h95q-936x-2qhf 
Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.
CVSS v3.0 score: 8.8
CVE-2017-18751 
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D7800 before 1.0.1.28, R6100 before 1.0.1.16, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.88, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS v3.0 score: 8.8
GHSA-wxvp-5pm4-8849 
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
CVSS v3.1 score: 9.8
CVE-2010-3909 
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
CVSS v2.0 score: 6
GHSA-w4rq-mvcf-xc7h 
Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
CVSS v3.1 score: 8.8
CVE-2007-0362 
Cross-site scripting (XSS) vulnerability in the RSS feed component in FreshReader before 1.0.07010600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to tag attributes.
CVSS v2.0 score: 6.8
RHSA-2026:1773 Red Hat Security Advisory: iperf3 security update
iperf3: iperf Heap Buffer Overflow
CVSS v3.1 score: 6.5
CVE-2025-2517 Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager
Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.
CVSS v4.0 score: 2.3
GHSA-9gqr-rx5g-cgrq 
Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the 'Set_short_poll_interval' command.
CVSS v3.1 score: 7.5
GHSA-7g54-vgp6-jj5w XML External Entity Reference in Apache Sling
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.
CVSS v3.0 score: 9.8
CVE-2018-14310 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of events. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6330.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-9qmw-g842-jq85 
Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command.
GHSA-3435-33m7-pm93 
Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.
CVSS v3.1 score: 6.3
GHSA-7c4m-hg3m-wrpf 
Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) core/select.php or (2) the city parameter to top_add.inc.php, reachable through sboard.php.
GHSA-6g5f-f6jh-vxmv 
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1327.
CVE-2026-47865 VMware Avi Load Balancer Authentication Bypass Vulnerability
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions:
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
CVSS v3.1 score: 9.8
GHSA-wxw6-fxw9-jh7g 
The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors.
CVSS v3.0 score: 7.5
CVE-2018-3906 
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0 score: 7.5
GHSA-v9r3-mcxc-m58r 
A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2023-5712 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
CVSS v3.1 score: 4.3
GHSA-xq75-p73c-3q2p 
Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
GHSA-45mc-x72w-r769 
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS v3.1 score: 8.6
CVE-2011-4921 
SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS v2.0 score: 5.1
GHSA-c9ph-vw97-ph4w 
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2025-27492 Windows Secure Channel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2018-4861 
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could potentially read and download arbitrary files from the device's file system. Successful exploitation requires that the attacker has network access to the web interface. The attacker must be authenticated as administrative user to exploit the security vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS v3.0 score: 4.9
CVSS v2.0 score: 4
CVE-2007-6659 
Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/.
CVSS v2.0 score: 4.3
GHSA-9rvw-7mx7-h53x CSRF vulnerability in Jenkins Database Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials.Database Plugin 1.7 requires POST requests for the affected form validation method.
CVSS v3.1 score: 5.4
CVE-2014-4356 
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.
CVSS v2.0 score: 2.1
RHSA-2012:1222 Red Hat Security Advisory: java-1.6.0-openjdk security update
OpenJDK: AWT hardening fixes (AWT, 7163201) OpenJDK: beans ClassFinder insufficient permission checks (beans, 7162476)
GHSA-hq29-gw6h-pjq7 
SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
RHSA-2020:2068 Red Hat Security Advisory: python-pip security update
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service python-urllib3: Certification mishandle when error should be thrown
CVSS v3.0 score: 7.5
ICSA-22-354-05 Delta 4G Router DX-3021
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.CVE-2022-4616 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0 score: 7.2
CVE-2017-14481 
In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS v3.0 score: 9.8
GHSA-rwcj-98w5-prvq 
A vulnerability has been found in code-projects Online Hotel Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/execedituser.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-xr2r-4cvv-wp49 
parse/Csv2_parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.
GHSA-c357-8h3r-2h9v 
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html.
CVSS v3.0 score: 6.1
GHSA-x6fh-9494-hx2r 
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url extensions.
CVE-2002-0967 
Buffer overflow in eDonkey 2000 35.16.60 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long "ed2k:" URL.
CVSS v2.0 score: 7.5