CIRCL/vulnerability-scores huggingface dataset:
GHSA-rqwj-3m8g-3w7f 
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "zone_name" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS v3.1 score: 8.8
GHSA-qwjm-gcr8-gjhw 
SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.
GHSA-8xhq-wvcf-g987 
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
CVSS v3.1 score: 7.5
GHSA-3h85-7292-2f8x 
The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
CVSS v3.1 score: 8.8
GHSA-g75p-hv6w-h9rw 
Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
GHSA-f7w6-w5p4-76pj 
The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.
CVE-2020-12815 
An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2026-48365 Audition | Out-of-bounds Write (CWE-787)
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
PYSEC-2019-181 
Python keyring lib before 0.10 created keyring files with world-readable permissions.
CVE-2024-7565 SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability
SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060.
CVSS v3.0 score: 7.8
CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
CVSS v3.1 score: 5.7
GHSA-ch35-564j-h4p4 
SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVE-2023-37304 
An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.
CVSS v3.1 score: 5.4
CVE-2003-0480 
VMware Workstation 4.0 for Linux allows local users to overwrite arbitrary files and gain privileges via "symlink manipulation."
CVSS v2.0 score: 3.7
GHSA-mc7v-26cq-j49v 
Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
GHSA-2hp7-6cr6-jvxh 
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
CVSS v3.1 score: 8.1
CVE-2020-4937 
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 191814.
CVSS v3.0 score: 5.9
GHSA-xmhm-4533-hmhq 
Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
GHSA-29mv-gccw-23pv 
The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.
CVSS v3.0 score: 9.8
GHSA-6mpj-cp6h-6c54 
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
CVSS v3.1 score: 7.6
CVE-2024-35409 
WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.
CVSS v3.1 score: 9.8
CVE-2009-1264 
Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.
CVSS v2.0 score: 4
GHSA-mh36-g5h5-fxqc 
In the Linux kernel, the following vulnerability has been resolved:af_unix: Fix UAF read of tail->len in unix_stream_data_wait()unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without
holding any lock that prevents SKBs on that queue from being dequeued and
freed.
This has been the case since commit 79f632c71bea ("unix/stream: fix
peeking with an offset larger than data in queue").
The first consequence of this is that the pointer comparison
`tail != last` can be false even if `last` semantically refers to an
already-freed SKB while `tail` is a new SKB allocated at the same address;
which can cause unix_stream_data_wait() to wrongly keep blocking after new
data has arrived, but only in a weird scenario where a peeking recv() and
a normal recv() on the same socket are racing, which is probably not a
real problem.But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream
af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in
the following race scenario (where test_setup() runs single-threaded,
and afterwards, test_thread1() and test_thread2() run concurrently in
two threads:when racing like this:Fix the UAF by removing the read of tail->len; checking tail->len would
only make sense if SKBs in the receive queue of a UNIX socket could grow,
which can no longer happen.Kuniyuki explained:When commit 869e7c62486e ("net: af_unix: implement stream sendpage
support") added sendpage() support, data could be appended to the last
skb in the receiver's queue.That's why we needed to check if the length of the last skb was changed
while waiting for new data in unix_stream_data_wait().However, commit a0dbf5f818f9 ("af_unix: Support MSG_SPLICE_PAGES") and
commit 57d44a354a43 ("unix: Convert unix_stream_sendpage() to use
MSG_SPLICE_PAGES") refactored sendmsg(), and now data is always added
to a new skb.That means this fix is not suitable for kernels before 6.5.
CVSS v3.1 score: 8.8
CVE-2018-1000854 
esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-wv6c-jqp4-7xg7 
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938.
GHSA-ggc6-38jq-q957 
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
CVSS v3.1 score: 9.8
CVE-2025-25257 
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
CVSS v3.1 score: 9.6
GHSA-jf9j-hx2j-m9xh CSRF vulnerability in Jenkins Database Plugin
Database Plugin 1.6 and earlier does not require POST requests for the database console, resulting in a cross-site request forgery (CSRF) vulnerability.This vulnerability allows attackers to execute arbitrary SQL scripts.Database Plugin 1.7 removes the database console.
CVSS v3.1 score: 8.8
CVE-2025-62581 DIAView - Authentication Bypass Vulnerability
Delta Electronics DIAView has multiple vulnerabilities.
CVSS v3.1 score: 9.8
GHSA-qrv7-cr6p-439g 
Unspecified vulnerability in the Java DB component in Oracle Java SE and Java for Business 6 Update 23, and, and earlier allows local users to affect confidentiality via unknown vectors related to Security, a similar vulnerability to CVE-2009-4269.
CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

Affected versions:
Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
CVSS v3.1 score: 8.1
CVE-2023-7227 Command Injection vulnerability in SystemK NVR 504/508/516

SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges.





CVSS v3.1 score: 9.8
RHSA-2024:10773 Red Hat Security Advisory: kernel-rt security update
kernel: x86/mm: Randomize per-cpu entry area kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: spi: Fix null dereference on suspend kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number kernel: nouveau: fix instmem race condition around ptr stores kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout kernel: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING kernel: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). kernel: drm/radeon: fix UBSAN warning in kv_dpm.c kernel: bpf: Fix overrunning reservations in ringbuf kernel: xfs: add bounds checking to xlog_recover_process_data kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() kernel: drm/amdgpu: avoid using null object of framebuffer kernel: tcp_metrics: validate source addr length kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation kernel: block: initialize integrity buffer to zero before writing it to media
CVSS v3.1 score: 5.5
GHSA-j2rq-9729-p9fr 
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow any authenticated user to spoof the configuration owner of any other user which disclose sensitive information or allow for unauthorized access. IBM X-Force ID: 176333.
CVE-2019-11190 
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
CVSS v3.0 score: 4.7
CVSS v2.0 score: 4.7
CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
CVSS v3.1 score: 3.1
RHSA-2025:0138 Red Hat Security Advisory: firefox security update
firefox: thunderbird: WebChannel APIs susceptible to confused deputy attack firefox: thunderbird: Use-after-free when breaking lines in text firefox: Alt-Svc ALPN validation failure when redirected firefox: Compartment mismatch when parsing JavaScript JSON module firefox: Memory corruption when using JavaScript Text Segmentation firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
CVSS v3.1 score: 7.5
CVE-2012-6026 
The HTTP Profiler on the Cisco Aironet Access Point with software 15.2 and earlier does not properly manage buffers, which allows remote attackers to cause a denial of service (device reload) via crafted HTTP requests, aka Bug ID CSCuc62460.
CVSS v2.0 score: 6.1
GHSA-fwhc-p6vj-fxwr 
Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
CVE-2024-56215 WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Member Directory and Contact Form: from n/a through <= 1.7.0.
CVSS v3.1 score: 4.3
GHSA-rcxc-3w2m-mp8h Unsafe deserialisation in the PKI implementation scheme of NVFlare
ImpactNVFLARE contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
All versions before 2.1.2 are affected.CVSS Score = 9.8
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln-metrics%2Fcvss%2Fv3-calculator%3Fvector%3DAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&data=05%7C01%7Cchesterc%40nvidia.com%7Ce9600bde16854b0b380008da4fc544f7%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637910005925574215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5kBrXEmAbqp8R31JCH%2FG95MUly72UPVihnBwiRFmvBY%3D&reserved=0)PatchesThe patch will be included in nvflare==2.1.2WorkaroundsReplace pickle serialization with JSON and change the code accordinglyAdditional information
Issue Found by: Oliver Sellwood (@Nintorac)
CVSS v3.1 score: 9.8
GHSA-cq4r-v726-cpj4 
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, Bypassing Physical Security.This issue affects ACS100 (Network Adjacent Access), ACS300 (Physical Access): from 5.2.4 before 6.2.4.3.
CVSS v3.1 score: 9
GHSA-775r-2987-9fpx 
A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0.
CVSS v3.1 score: 9.8
CVE-2026-27653 
The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be executed with SYSTEM privileges.
CVSS v4.0 score: 5.4
CVSS v3.0 score: 6.7
CVE-2022-21159 
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
CVSS v3.0 score: 7.5
CVE-2020-20808 
Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php.
CVSS v3.1 score: 6.1
CVE-2013-3978 
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send the appropriate HTTP response headers to prevent unwanted caching by a web browser, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS v2.0 score: 5
GHSA-pv8r-xmqx-g2r9 
Re-pairing with a legitimate device can use a lower security level than
previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
CVSS v3.1 score: 8.8
CVE-2022-29131 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
GHSA-8x22-734g-2233 
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/UserPopupAddNewProp.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS v3.0 score: 6.1
GHSA-7m8x-6p9r-hr77 
Cross-site scripting (XSS) vulnerability in auth/message.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-9qvp-w68q-7r55 
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
CVSS v3.1 score: 7.5
GHSA-q7gv-xfx9-7f68 
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A local user may be able to modify protected parts of the file system.
GHSA-87pc-37fx-hf9w 
The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2020-13805 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 5
CVE-2019-17556 
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
GHSA-2rxj-58vc-g6vw 
Buffer overflow in listmanager earlier than 2.105.1 allows local users to gain additional privileges.
RHSA-2013:1120 Red Hat Security Advisory: haproxy security update
haproxy: http_get_hdr()/get_ip_from_hdr2() MAX_HDR_HISTORY handling denial of service
GHSA-72xj-c9f2-v6rh 
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
CVSS v3.1 score: 7.5
CVE-2023-51098 
Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .
CVSS v3.1 score: 9.8
GHSA-jrhm-8c88-jfrv 
Unknown vulnerability in the telnet KIO subsystem (telnet.protocol) of KDE 2.x 2.1 and later allows local and remote attackers to execute arbitrary code via a certain URL.
GHSA-mx43-r985-5h4m Open redirect vulnerability in Sourcegraph
ImpactAn open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by an attacker.Specific Go Packages Affectedgithub.com/sourcegraph/sourcegraph/cmd/frontend/authResolutionSourcegraph v3.14.4 and v3.15.1 have been released which resolve the vulnerability. ([associated change](https://github.com/sourcegraph/sourcegraph/pull/10167))WorkaroundsDisabling OAuth, OpenID and/or SAML sign-in options until upgraded to the patched versions will secure Sourcegraph / workaround the issue.TimelineApr 23, 8 AM PST: GitHub Security Lab reported the issue to Sourcegraph.Apr 23, 11 PM PST: A Sourcegraph engineer proposed a resolution for the vulnerability. https://github.com/sourcegraph/sourcegraph/pull/10167Apr 24, 3 AM PST: The proposed resolution was reviewed, approved, and merged.Apr 28, 2 PM PST: Patch releases for 3.14.4 and 3.15.1 were published.Apr 29, 10 PM PST: Mitre publicly disclosed [CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283).Apr 30, 11 AM PST: Sourcegraph issued a GitHub security advisory and notified all affected users.References[Mitre: CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283)[GitHub Security Lab: GHSL-2020-085](https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph)[detectify's blog post on open redirect vulnerabilities
](https://blog.detectify.com/2019/05/16/the-real-impact-of-an-open-redirect/)For more informationIf you have any questions or comments about this advisory, please contact us at [support@sourcegraph.com](mailto:support@sourcegraph.com) and include `CVE-2020-12283` in the title.
CVSS v3.1 score: 6.1
CVE-2014-6817 
The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
CVE-2016-9972 
IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 120208.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2024-13356 DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion
The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the user_remove_form.php file. This makes it possible for unauthenticated attackers to delete admin user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 6.5
GHSA-h8fv-x4w5-c9mc 
In tpu_get_int_state of tpu.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 5.5
GHSA-4jcr-vf56-7rjc 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges. IBM X-Force ID: 236690.
CVSS v3.1 score: 8.4
CVE-2014-4369 
The IOAcceleratorFamily API implementation in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via an application that uses crafted arguments.
CVSS v2.0 score: 7.8
GHSA-cvw4-c76x-fw5r 
Unknown vulnerability in HP ProLiant DL585 servers running Integrated Lights Out (ILO) firmware before 1.81 allows attackers to access server controls when the server is "powered down."
GHSA-2q8v-6q3v-prjc 
Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process.The specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276.
CVSS v3.0 score: 8
CVE-2020-3932 Draytek VigorAP910C - Information Leakage
A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.
CVSS v3.1 score: 7.5
GHSA-hm94-6x26-h4hh 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
GHSA-938r-jjfm-4vxv 
Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software.
GHSA-2fhp-49gm-838v 
A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module.
CVSS v3.1 score: 4.6
GHSA-mvjm-8853-rpx4 
In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).
CVSS v3.0 score: 5.5
GHSA-vj9r-56j4-wwmh 
In the Linux kernel, the following vulnerability has been resolved:net: mvpp2: sync RX data at the hardware packet offsetmvpp2 programs the RX queue packet offset, so hardware writes received
data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at
dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the
unused headroom and misses the same number of bytes at the packet tail.On non-coherent DMA systems this can leave the CPU reading stale cache
contents for the end of the received frame.Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range
offset so the sync covers the Marvell header and packet data actually
written by hardware.
CVSS v3.1 score: 8.6
RHEA-2020:1416 Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.1.0 RPMs
istio/envoy: mishandling regular expressions for long URIs leading to DoS envoy: crafted request with long URI allows remote attacker to cause denial of service
CVSS v3.0 score: 7.5
GHSA-wj34-x9vq-hmjj 
Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Rights.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS v3.0 score: 6.1
GHSA-gf86-x7w3-vm22 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and availability via unknown vectors related to Libraries.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "XML security and the class loader."
CVE-2023-32885 
In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780685; Issue ID: ALPS07780685.
CVSS v3.1 score: 6.7
CVE-2023-6265 DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.
CVSS v3.1 score: 6.5
RHSA-2025:16124 Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.17.2-1 Update
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
CVSS v3.1 score: 5.4
CVE-2024-41941 
A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and modify settings in the application without authorization.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2025-5307 Santesoft Sante DICOM Viewer Pro Out-of-bounds Read
Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and to execute arbitrary code on affected installations of Sante DICOM Viewer Pro.
CVSS v4.0 score: 8.4
CVSS v3.1 score: 7.8
GHSA-5m6j-4pqm-4ch5 
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Tuxedo). Supported versions that are affected are 8.54 and 8.55. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0 score: 4.7
CVE-2017-0798 
A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36100671. References: M-ALPS03365532.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-q6gr-fq83-8hmc 
An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.2 through 3.2.4 and 3.1.5 allows attacker to information disclosure via HTTP get requests.
CVSS v3.1 score: 4.3
CVE-2024-35919 media: mediatek: vcodec: adding lock to protect encoder context list
In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: adding lock to protect encoder context list

Add a lock for the ctx_list, to avoid accessing a NULL pointer
within the 'vpu_enc_ipi_handler' function when the ctx_list has
been deleted due to an unexpected behavior on the SCP IP block.
CVSS v3.1 score: 7.8
GHSA-7g9c-3hjm-r38g 
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, and RBR850 before 3.2.17.12.
CVSS v3.1 score: 9.8
GHSA-38g6-9fgr-3mmj 
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-6jqr-c9h5-fg6v 
Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp.
CVE-2023-48121 
An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x build 20230401, Ezviz CS-C6CN-xxx prior to v5.3.x build 20230401, Ezviz CS-C3N-xxx prior to v5.3.x build 20230401 allows remote attackers to obtain sensitive information by sending crafted messages to the affected devices.
CVSS v3.1 score: 5.3
CVE-2007-2466 
Unspecified vulnerability in the LDAP Software Development Kit (SDK) for C, as used in Sun Java System Directory Server 5.2 up to Patch 4 and Sun ONE Directory Server 5.1, allows remote attackers to cause a denial of service (crash) via certain BER encodings.
CVSS v2.0 score: 7.8
GHSA-vvjc-7c69-j5q9 
Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Illustrator.
CVSS v3.1 score: 7.8
GHSA-35q9-5269-p4j4 
The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.
GHSA-j2pc-v64r-mv4f Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
SummaryThe expected `protocDigest` is ignored when protoc is taken from the `PATH`.DetailsThe documentation for the `protocDigest` parameter says:... Users may wish to specify this if using a `PATH`-based binary ...However, when specifying `<protoc>PATH</protoc>` the `protocDigest` is not actually checked because the code returns here already
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L91-L93before the digest check:
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L106PoCSpecify:And notice how the `protoc` on the `PATH` is not rejected, despite a digest mismatch.ImpactUsers who have an untrusted `protoc` executable on their `PATH` and rely `<protocDigest>` as protection are affected.
CVSS v4.0 score: 1
CVE-2022-30681 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
CVSS v3.0 score: 5.4
CVE-2023-26491 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.
CVSS v3.1 score: 5.4
GHSA-8p7c-2mvg-g9v9 
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1 score: 8.8
CVE-2023-44210 
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29258, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
CVSS v3.0 score: 7.3
GHSA-p44m-phj9-qm2q 
The buffer overflow trigger in Cisco Security Agent (CSA) before 4.0.3 build 728 waits five minutes for a user response before terminating the process, which could allow remote attackers to bypass the buffer overflow protection by sending additional buffer overflow attacks within the five minute timeout period.
GHSA-944h-rj85-r36p 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA templates. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10132.
RHSA-2016:0054 Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries) TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) OpenJDK: URL deserialization inconsistencies (Networking, 8059054) OpenJDK: logging of RMI connection secrets (JMX, 8130710) OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
CVE-2019-1960 Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.0 score: 4.4
GHSA-cvw3-jq65-vv6q 
Multiple directory traversal vulnerabilities in MMS Gallery PHP 1.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) get_image.php or (2) get_file.php in mms_template/.
GHSA-wwrq-jww7-39jq 
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.
GHSA-28fv-vpxc-gmp4 
An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2024-8185 Vault Vulnerable to Denial of Service When Processing Raft Join Requests
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself.

This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.
CVSS v3.1 score: 7.5
GHSA-98j3-hjh2-q3pv 
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data.We have already fixed the vulnerability in the following version:
License Center 2.0.36 and later
CVSS v4.0 score: 1.3
CVSS v3.1 score: 6.5
GHSA-8gm5-9276-cvrc 
AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.
CVSS v3.1 score: 7.5
CVE-2012-0309 
Cross-site scripting (XSS) vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
RHSA-2025:2861 Red Hat Security Advisory: tigervnc security update
X.Org: Xwayland: Use-after-free of the root cursor Xorg: xwayland: Buffer overflow in XkbVModMaskText() xorg: xwayland: Heap overflow in XkbWriteKeySyms() xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() xorg: xwayland: Use-after-free in PlayReleasedEvents() xorg: xwayland: Use-after-free in SyncInitTrigger()
CVSS v3.1 score: 7.8
RHSA-2016:1815 Red Hat Security Advisory: kernel security and bug fix update
kernel: challenge ACK counter information disclosure.
CVSS v3.0 score: 4.8
CVE-2017-2114 
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
RHSA-2020:0981 Red Hat Security Advisory: ipmitool security update
ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c
CVSS v3.1 score: 8.1
CVE-2025-27216 
Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges.
CVSS v3.1 score: 8.8
CVE-2023-38902 
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.
CVSS v3.1 score: 8.8
GHSA-f7pg-m34f-mphj 
Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.
GHSA-2qgw-f6xw-qj35 
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to determine kernel memory layout.
CVE-2008-4889 
SQL injection vulnerability in index.php in deV!L'z Clanportal (DZCP) 1.4.9.6 and earlier allows remote attackers to execute arbitrary SQL commands via the users parameter in an addbuddy operation in a buddys action.
CVSS v2.0 score: 7.5
CVE-2026-20919 Windows SMB Server Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
CVSS v3.1 score: 7.5
CVE-2013-3734 
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code.  NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console
CVSS v3.0 score: 6.6
CVSS v2.0 score: 6
GHSA-j93q-cmv6-9xr7 
Cross-site scripting (XSS) vulnerability in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0 score: 6.1
GHSA-h2rr-xr3h-c5q7 
A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/modules/student/complaint.php of the component Complaint Form Page. This manipulation of the argument Complaint causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0 score: 2
CVSS v3.1 score: 3.5
GHSA-jw8p-752q-4f34 
A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-xvf8-4rmq-w4c4 
This affects all versions of package s3-kilatstorage.
CVSS v3.1 score: 9.8
CVE-2023-38825 
SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password reset mechanism in MyCapMobileApp/update.php.
CVSS v3.1 score: 9.8
GHSA-9vj9-gvm3-4fxv 
eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application.
CVSS v3.0 score: 7.8
GHSA-mgw8-pg67-5pw5 
In the Linux kernel, the following vulnerability has been resolved:tpm: Make the TPM character devices non-seekableThe TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:sequential partial reads returned the complete responsepread() and preadv() with offset 0x1400 returned -ESPIPEpwrite() and pwritev() with offset zero returned -ESPIPEthe pending response remained intact after the rejected operationsa subsequent normal command/response cycle completed normallyno KASAN report was produced.
CVSS v3.1 score: 7.8
GHSA-pqhf-8hv3-ccc7 
IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system.
CVSS v3.1 score: 6.3