CIRCL/vulnerability-scores huggingface dataset:
CVE-2024-26791 btrfs: dev-replace: properly validate device names
In the Linux kernel, the following vulnerability has been resolved:

btrfs: dev-replace: properly validate device names

There's a syzbot report that device name buffers passed to device
replace are not properly checked for string termination which could lead
to a read out of bounds in getname_kernel().

Add a helper that validates both source and target device name buffers.
For devid as the source initialize the buffer to empty string in case
something tries to read it later.

This was originally analyzed and fixed in a different way by Edward Adam
Davis (see links).
CVSS v3.1 score: 7.1
CVE-2020-27636 
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
CVSS v3.1 score: 9.1
CVE-2006-2169 
RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message.
CVSS v2.0 score: 5
CVE-2018-0966 
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVSS v3.0 score: 3.3
CVSS v2.0 score: 2.1
CVE-2014-6739 
The Well-Being Connect Mobile (aka com.healthways.wellbeinggo) application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
CVSS v3.1 score: 6.5
GHSA-rhgq-m6r3-xf46 
Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a " (double quote) character, a different vulnerability than CVE-2013-0230.
CVE-2005-2218 
The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes hidden devices available to attackers, who can then bypass restrictions on a jailed process.
CVSS v2.0 score: 7.2
GHSA-ggv5-rh8q-h8h7 
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access sensitive user data.
CVSS v3.1 score: 4.7
GHSA-63qq-8356-xpg6 
Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function calls in IBM DB2 8.1 allow remote attackers to execute arbitrary code via a 94-byte second argument, which causes the return address to be overwritten with a pointer to the argument.
GHSA-36q8-mfw8-2m98 
The WP ULike  WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS v3.1 score: 4.8
RHSA-2025:15662 Red Hat Security Advisory: kernel security update
kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVSS v3.1 score: 7.8
GHSA-4fx8-jx6v-vjhj 
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
CVSS v3.0 score: 5.5
CVE-2017-7309 
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
GHSA-h6cr-c397-vq66 
A use-after-free in AnimationController::endAnimationUpdate in Google Chrome.
CVSS v3.0 score: 9.8
GHSA-gpw9-cfwq-7rm5 
IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
GHSA-j59g-pjr7-6mxg 
Microsoft Office Remote Code Execution Vulnerability
CVSS v3.1 score: 7.8
CVE-2008-0002 
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
CVSS v2.0 score: 5.8
CVE-2019-19394 
Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2025-5063 
Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2025-10415 Campcodes Grocery Sales and Inventory System ajax.php sql injection
A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=save_supplier. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-2fjp-hx49-4fqh 
Array index error in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher 97 file, aka "Memory Corruption Due To Invalid Index Into Array in Pubconv.dll Vulnerability."
CVE-2023-53539 RDMA/rxe: Fix incomplete state save in rxe_requester
In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix incomplete state save in rxe_requester

If a send packet is dropped by the IP layer in rxe_requester()
the call to rxe_xmit_packet() can fail with err == -EAGAIN.
To recover, the state of the wqe is restored to the state before
the packet was sent so it can be resent. However, the routines
that save and restore the state miss a significnt part of the
variable state in the wqe, the dma struct which is used to process
through the sge table. And, the state is not saved before the packet
is built which modifies the dma struct.

Under heavy stress testing with many QPs on a fast node sending
large messages to a slow node dropped packets are observed and
the resent packets are corrupted because the dma struct was not
restored. This patch fixes this behavior and allows the test cases
to succeed.
CVSS v3.1 score: 7.8
GHSA-grvm-c676-wgqq 
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.75, D6000 before V1.0.0.75, D6100 before V1.0.0.63, R7800 before v1.0.2.52, R8900 before v1.0.4.2, R9000 before v1.0.4.2, RBK50 before v2.3.0.32, RBR50 before v2.3.0.32, RBS50 before v2.3.0.32, WNDR3700v4 before V1.0.2.102, WNDR4300v1 before V1.0.2.104, WNDR4300v2 before v1.0.0.58, WNDR4500v3 before v1.0.0.58, WNR2000v5 before v1.0.0.68, and XR500 before V2.3.2.32.
CVE-2014-8523 
Cross-site request forgery (CSRF) vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS v2.0 score: 6.8
GHSA-w8j7-864p-92c6 
Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls.  NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure.
GHSA-f7j2-6ch3-r72r 
SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system.
CVSS v3.1 score: 9.8
CVE-2024-54399 WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through <= 1.0.2.
CVSS v3.1 score: 7.1
GHSA-wv93-f9g8-qg2r 
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 7.2
CVE-2026-8959 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVSS v3.1 score: 9.6
GHSA-f8m7-cqq6-85jp 
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258300.
CVSS v3.1 score: 6.3
GHSA-6qq9-gwrw-53gj 
System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request.
CVSS v3.0 score: 9.8
GHSA-7wxc-7qrg-rg6w Jenkins JClouds Plugin missing permission check
Jenkins JClouds Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.This form validation method now requires POST requests and Overall/Administer permission.
CVSS v3.0 score: 4.2
CVE-2008-5695 
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
CVSS v2.0 score: 8.5
CVE-2015-3376 
Cross-site scripting (XSS) vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
CVSS v2.0 score: 3.5
CVE-2009-0682 
vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.
CVSS v2.0 score: 2.1
CVE-2026-11174 
Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 5.3
GHSA-q2v7-xv64-8j7v 
Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.
CVSS v3.1 score: 8.8
CVE-2019-8776 
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with system privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
CVE-2019-13726 
Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2024-0366 Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference
The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for subscribers to view plugin preferences and potentially other user settings.
CVSS v3.1 score: 4.3
CVE-2024-8325 Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blockspare_render_social_sharing_block’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-6wc6-7j53-rh84 
Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.
GHSA-x3p4-v5g6-w6pw 
Out of bounds write in Intel BIOS platform sample code for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
GHSA-xq5v-6pm7-4qw9 
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
CVSS v4.0 score: 2.3
CVSS v3.1 score: 9.1
CVE-2011-3104 
Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS v2.0 score: 5
CVE-2021-26813 
markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-28mw-j8x6-mf8x 
PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip.This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.3
CVE-2007-1434 
SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) userdetail.php, id and (2) url parameter to (b) jump.php, and id variable to (c) detail.php.
CVSS v2.0 score: 7.5
CVE-2018-6061 
A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5.1
GHSA-6826-cff7-fh67 
ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.1
CVE-2022-25721 Incorrect Type Conversion in Video driver
Memory corruption in video driver due to type confusion error during video playback
CVSS v3.1 score: 6.7
CVE-2004-2498 
Unspecified vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier, when using the default error template and debug mode is set to ON, allows remote attackers to determine internal directory structures via unknown attack vectors.
CVSS v2.0 score: 5
CVE-2018-20231 
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-gxcf-x722-p7ch 
SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an addcomment action, a different vector than CVE-2006-1666.
GHSA-w4hc-m7gc-628v 
There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
GHSA-6ph9-24mm-7chj 
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
GHSA-hq4h-w933-jm6c khoj has an IDOR in subscription management allows unauthorized subscription modifications
SummaryAn Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request.DetailsThe vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.Vulnerable code in `/api/subscription`:PoCCreate a customer account in stripe:Customer A: `adventure8812@zeropath.com` (attacker)Log in as any user.Send this request:The subscription for Customer A is successfully set to cancel.ImpactHigh:
Revenue loss via mass cancellation of subscriptions.
Loss of customer trust by re-enabling subscriptions they had set to cancel.ResolutionThis was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.
CVSS v3.1 score: 4.3
RHSA-2022:5095 Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update
grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling grub2: Crafted JPEG image can lead to buffer underflow write in the heap grub2: Integer underflow in grub_net_recv_ip4_packets grub2: Out-of-bound write when handling split HTTP headers grub2: shim_lock verifier allows non-kernel files to be loaded grub2: use-after-free in grub_cmd_chainloader() shim: Buffer overflow when loading crafted EFI images
CVSS v3.1 score: 7.3
CVE-2019-11969 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-8pjv-4cvr-48f4 
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
CVSS v3.1 score: 7.2
GHSA-3wq5-3f56-v5xc Mattermost vulnerable to information disclosure
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
CVSS v3.1 score: 5.3
ICSA-25-162-06 Siemens Energy Services
Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.
CVSS v3.1 score: 9.9
CVE-2025-38723 LoongArch: BPF: Fix jump offset calculation in tailcall
In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix jump offset calculation in tailcall

The extra pass of bpf_int_jit_compile() skips JIT context initialization
which essentially skips offset calculation leaving out_offset = -1, so
the jmp_offset in emit_bpf_tail_call is calculated by

"#define jmp_offset (out_offset - (cur_offset))"

is a negative number, which is wrong. The final generated assembly are
as follow.

54:	bgeu        	$a2, $t1, -8	    # 0x0000004c
58:	addi.d      	$a6, $s5, -1
5c:	bltz        	$a6, -16	    # 0x0000004c
60:	alsl.d      	$t2, $a2, $a1, 0x3
64:	ld.d        	$t2, $t2, 264
68:	beq         	$t2, $zero, -28	    # 0x0000004c

Before apply this patch, the follow test case will reveal soft lock issues.

cd tools/testing/selftests/bpf/
./test_progs --allow=tailcalls/tailcall_bpf2bpf_1

dmesg:
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]
CVSS v3.1 score: 5.5
CVE-2013-1649 
Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
CVSS v2.0 score: 4.3
GHSA-h3h2-jhj6-f5mg 
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Guest Access. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Guest Access. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0 score: 4.9
CVE-2023-36590 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVSS v3.1 score: 7.3
GHSA-g7mf-pj82-5qhj 
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
CVSS v3.1 score: 5.5
GHSA-5c89-5mrj-8h62 
Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.  IBM X-Force ID:  280203.
CVSS v3.1 score: 8.4
GHSA-cc8c-26rj-v2vx administrate vulnerable to Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
CVSS v3.1 score: 5.4
GHSA-4crv-r584-pr4j 
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by incorrect transport being used when Liberty is configured to use Java Authentication SPI for Containers (JASPIC). This can happen when the Application Server is configured to permit access on non-secure (http) port and using JASPIC or JSR375 authentication.
CVSS v3.0 score: 5.9
GHSA-2xwm-fqp4-pw7f 
Unknown vulnerability in xitalk 1.1.11 and earlier allows local users to execute arbitrary commands.
CVE-2008-3154 
SQL injection vulnerability in index.php in WebBlizzard CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS v2.0 score: 7.5
GHSA-2h33-8gg4-v626 
Cisco IOS before 15.1(1)SY allows local users to cause a denial of service (device reload) by establishing an outbound SSH session, aka Bug ID CSCto00318.
GHSA-hcc4-r9c5-cv8f 
The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".
GHSA-82xj-4wm9-29x6 
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.2.8, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
CVSS v3.1 score: 9.1
GHSA-9rw7-2gcj-3x9m 
Paging function in O'Reilly WebBoard Pager 4.10 allows remote attackers to cause a denial of service via a message with an escaped ' character followed by JavaScript commands.
GHSA-rwvj-3jx7-frmw 
This issue was addressed with improved handling of symlinks. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to delete files for which it does not have permission.
CVSS v3.1 score: 9.8
GHSA-3wh6-ghqv-v6wx 
IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.
CVSS v3.1 score: 9.8
CVE-2025-13030 
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authentication protection and proper sanitisation of file names.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 7.1
GHSA-8r2m-wqj6-fr2r 
SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.
CVSS v3.1 score: 8.6
GHSA-3g5h-5mpr-m5qx 
SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter.
RHSA-2015:1037 Red Hat Security Advisory: Red Hat Satellite Proxy 5 - End Of Life Notice
This is the final notification of the End Of Life (EOL) plans for the following versions of Red Hat Satellite Proxy 5:

* Red Hat Satellite Proxy 5.2 
* Red Hat Satellite Proxy 5.3
* Red Hat Satellite Proxy 5.4
* Red Hat Satellite Proxy 5.5
CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS v3.1 score: 3.7
GHSA-3h82-23p6-hhff 
Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.This issue affects Classified Listing: from n/a through <= 5.3.4.
CVSS v3.1 score: 6.5
GHSA-fmfp-q8w9-qgxv 
fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.
CVSS v3.0 score: 5.5
GHSA-jx2x-j75f-xq3j Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
SummaryThe `POST /api/v1/notes/{id}/pin` endpoint performs a write operation (toggling the `is_pinned` field) but only checks for `read` permission. Users with read-only access to a shared note can pin/unpin it, which is a state-modifying action that should require `write` permission. All other write endpoints (update, delete, access/update) correctly check for `write` permission.Details**Affected code: `backend/open_webui/routers/notes.py` lines 412-444****Compare with update endpoint (correct, line 318-327):**PoC**Environment:** Open WebUI v0.9.2, default configuration with notes sharing enabled.**Setup:**UserA creates a noteUserA shares note with UserB with `read` permission via `POST /api/v1/notes/{id}/access/update` with `{"access_grants":[{"principal_type":"user","principal_id":"USERB_ID","permission":"read"}]}`**Test:****E2E Verified Result:**Step 1: UserB reads note (READ) -> 200 OK ✓Step 2: UserB updates note (WRITE) -> 403 Forbidden ✓ (correctly blocked)Step 3: UserB pins note (WRITE via READ) -> 200 OK, is_pinned: true ✗ (BUG)Step 4: UserB toggles pin again -> 200 OK, is_pinned: false ✗ (repeated write)ImpactA user with only `read` access to a shared note can toggle its `is_pinned` statusThis modifies the note's state without write authorizationThe pin status change is visible to the note owner and all other users with accessPrivilege escalation from read to write on the pin operation**Limitations:** Only affects the `is_pinned` boolean field. Cannot modify title, content, or access_grants. Requires at least read access via explicit sharing.FixOne-line fix — change `permission='read'` to `permission='write'` in `pin_note_by_id`:This makes the pin endpoint consistent with update and delete endpoints.
CVSS v3.1 score: 3.5
CVE-2024-36225 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
cisco-sa-asa-ftd-acl-bypass-mtPze9Yh Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability
A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface.

This vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic that should have been blocked to a loopback interface on the device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



This advisory is part of the August 2025 release of the Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: August 2025 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75415"].
CVSS v3.1 score: 5.3
GHSA-jhj9-jh88-9vjh 
The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.
CVSS v3.1 score: 5.3
CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom
OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.
CVSS v4.0 score: 7.7
CVSS v3.1 score: 8.8
GHSA-h84p-rcw9-4mc8 
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
GHSA-mgvr-5qfh-f7r5 
Multiple cross-site scripting (XSS) vulnerabilities in PG Roommate Finder Solution allow remote attackers to inject arbitrary web script or HTML via the part parameter to (1) quick_search.php and (2) viewprofile.php.
GHSA-543q-9rm2-x5f3 
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.
GHSA-vfhj-j6fq-rcph 
JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interface. The application fails to properly validate file path input, allowing remote, unauthenticated attackers to access arbitrary files on the underlying filesystem within the context of the web server. This may result in disclosure of system configuration files and other sensitive information.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-c54q-7px7-pfhr 
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's  Posts Grid widget in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2019-17404 
Nokia IMPACT < 18A: allows full path disclosure
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4
RHSA-2017:2931 Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: net: Out of bounds stack read in memcpy_fromiovec kernel: Out-of-bounds heap access in xfrm kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx() kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack kernel: Use-after-free in sys_mq_notify() kernel: Divide-by-zero in __tcp_select_window kernel: Heap out-of-bounds read in AF_PACKET sockets kernel: Exploitable memory corruption due to UFO to non-UFO path switch
CVSS v3.0 score: 7
GHSA-jq4c-f823-cpw5 
The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages.
GHSA-pjgv-jp84-vf63 
The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil, allows local users to gain privileges via a malicious InputManager in Library/InputManagers in a user's home directory, which is executed when Cocoa applications attempt to notify the user.
CVE-2025-30958 WordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.
CVSS v3.1 score: 5.4
GHSA-fq8v-7xvx-q6q2 
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 8.1
GHSA-6j5p-3mwx-76vw 
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
CVSS v3.1 score: 9.8
CVE-2023-25070 
Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product.
CVSS v3.1 score: 4.8
CVE-2024-24889 WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9.
CVSS v3.1 score: 6.1
GHSA-qq3c-qjcf-2272 
The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.
RHSA-2026:2233 Red Hat Security Advisory: python3.12 security update
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: Excessive read buffering DoS in http.client
CVSS v3.1 score: 6.8
GHSA-j6j8-v7g3-3x5w 
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
CVSS v3.1 score: 5.9
CVE-2022-30062 
ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2016-4946 
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-93gw-9w6q-fxw3 
LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors.
CVE-2023-44173 Online Movie Ticket Booking System v1.0 - Reflected Cross-Site Scripting (XSS)
Online Movie Ticket Booking System v1.0 is vulnerable to

an authenticated Reflected Cross-Site Scripting vulnerability.




CVSS v3.1 score: 5.4
CVE-2006-4256 
index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites, which could be useful for phishing attacks, via a URL in the url parameter, aka "cross-site referencing." NOTE: some sources have referred to this issue as XSS, but it is different than classic XSS.
CVSS v2.0 score: 4.3
GHSA-vmw7-mxgc-c8qm 
CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
CVSS v3.0 score: 6.1
CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.
CVSS v3.1 score: 6.5
RHSA-2024:5137 Red Hat Security Advisory: python-setuptools security update
pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools
CVSS v3.1 score: 8.8
GHSA-g8cq-pwcv-27g6 
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
CVE-2025-10947 Sistemas Pleno Gestão de Locação CPF validarCpf authorization
A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument pes_cpf can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 2025.8.0 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-g892-qv2j-3m88 
A vulnerability was found in mapoor voteapp. It has been rated as critical. Affected by this issue is the function create_poll/do_poll/show_poll/show_refresh of the file app.py. The manipulation leads to sql injection. The name of the patch is b290c21a0d8bcdbd55db860afd3cadec97388e72. It is recommended to apply a patch to fix this issue. VDB-217790 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 9.8
CVE-2022-25705 Integer Overflow to Buffer Overflow in Modem
Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
CVSS v3.1 score: 7.8
GHSA-r2mg-8x37-x2q4 
In the Linux kernel, the following vulnerability has been resolved:udf: validate sparing table length as an entry count, not a byte countudf_load_sparable_map() accepts a sparing table whenis false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block.  But the table is walked as an array of 8-byte
sparingEntry elements:in udf_get_pblock_spar15() and udf_relocate_blocks().  A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block.  On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.Validate reallocationTableLen as the entry count it is, with
struct_size().
CVSS v3.1 score: 7.8
GHSA-8j65-cc62-w2hg 
In the Linux kernel, the following vulnerability has been resolved:iio: adc: ad_sigma_delta: fix CS held asserted and state leaksIn ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and
disable_one() were called from the out: block while keep_cs_asserted
was still true. This caused any SPI transfer issued by those callbacks
to carry cs_change=1, leaving CS permanently asserted after the
conversion. Fix by moving both calls into the out_unlock: block, after
keep_cs_asserted is cleared, matching the pattern already used in
ad_sd_calibrate().In the error path of ad_sd_buffer_postenable(), if an operation fails
after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.
spi_offload_trigger_enable()), the device is left in continuous
conversion mode with CS physically asserted. Additionally,
bus_locked remaining true after spi_bus_unlock() causes subsequent
SPI operations to call spi_sync_locked() without the bus lock actually
held, allowing concurrent SPI access.Fix the error path by clearing keep_cs_asserted first, then calling
set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,
then clearing bus_locked before releasing the bus.For devices that implement neither set_mode nor disable_one (such as
MAX11205, which has no physical CS pin), no SPI transfer is issued
during cleanup and the cs_change flag has no effect on any physical
line.
CVSS v3.1 score: 7.1
GHSA-rh3v-mpfh-4wwj 
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
CVSS v3.0 score: 9.8
GHSA-qhw4-wwr7-gjc5 TensorFlow vulnerable to `CHECK` fail in `EmptyTensorList`
ImpactIf `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CHECK` fail that can be used to trigger a denial of service attack.PatchesWe have patched the issue in GitHub commit [c8ba76d48567aed347508e0552a257641931024d](https://github.com/tensorflow/tensorflow/commit/c8ba76d48567aed347508e0552a257641931024d).The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Kang Hong Jin.
CVSS v3.1 score: 5.9
CVE-2023-36161 
An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.
CVSS v3.1 score: 7.5
CVE-2026-20601 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user permission.
CVSS v3.1 score: 3.3
GHSA-vqwg-4v6f-h6x5 Stored XSS vulnerability in Matrix Project Plugin
Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions.This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.
CVSS v3.1 score: 5.4