ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wh3g-6vr6-mqjg: The makefile in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices omits the -fno-strict-overflow option to gcc, which might allow attackers to gain privileges via a crafted application that leverages incorrect compiler optimization of an integer-overflow protection mechanism, aka Android internal bug 28821731 and Qualcomm internal bug CR691916.
CVSS v3.0: 7.8
CVE-2018-14593: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2024-36526: ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
CVSS v3.1: 9.8
CVE-2025-48985: A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
CVSS v3.1: 3.7
CVE-2017-11582: dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-g5h3-w546-pj7f: Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
CVSS v3.1: 9.8
CVE-2023-36025: Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVSS v3.1: 8.8
CVE-2016-0739: libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
CVSS v3.0: 5.9
CVSS v2.0: 4.3
CVE-2024-10786: Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
CVSS v3.1: 4.3
RHSA-2006:0281: Red Hat Security Advisory: struts security update for Red Hat Application Server
struts bypass validation security flaw struts LookupDispatchAction XSS
GHSA-c4vm-rj4p-m3c8: In the Linux kernel, the following vulnerability has been resolved:bpf: Fix a sdiv overflow issueZac Ecob reported a problem where a bpf program may cause kernel crash due
to the following error:
  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTIThe failure is due to the below signed divide:
  LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.
LLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,
but it is impossible since for 64-bit system, the maximum positive
number is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will
cause a kernel exception. On arm64, the result for LLONG_MIN/-1 is
LLONG_MIN.Further investigation found all the following sdiv/smod cases may trigger
an exception when bpf program is running on x86_64 platform:LLONG_MIN/-1 for 64bit operationINT_MIN/-1 for 32bit operationLLONG_MIN%-1 for 64bit operationINT_MIN%-1 for 32bit operation
where -1 can be an immediate or in a register.On arm64, there are no exceptions:LLONG_MIN/-1 = LLONG_MININT_MIN/-1 = INT_MINLLONG_MIN%-1 = 0INT_MIN%-1 = 0
where -1 can be an immediate or in a register.Insn patching is needed to handle the above cases and the patched codes
produced results aligned with above arm64 result. The below are pseudo
codes to handle sdiv/smod exceptions including both divisor -1 and divisor 0
and the divisor is stored in a register.sdiv:
      tmp = rX
      tmp += 1 /* [-1, 0] -> [0, 1]
      if tmp >(unsigned) 1 goto L2
      if tmp == 0 goto L1
      rY = 0
  L1:
      rY = -rY;
      goto L3
  L2:
      rY /= rX
  L3:smod:
      tmp = rX
      tmp += 1 /* [-1, 0] -> [0, 1]
      if tmp >(unsigned) 1 goto L1
      if tmp == 1 (is64 ? goto L2 : goto L3)
      rY = 0;
      goto L2
  L1:
      rY %= rX
  L2:
      goto L4  // only when !is64
  L3:
      wY = wY  // only when !is64
  L4:[1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/
CVSS v3.1: 5.5
GHSA-7fq3-f4x6-fmg6: IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.
RHSA-2022:8870: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-neutron) security update
openstack-neutron: unrestricted creation of security groups
CVSS v3.1: 4.3
GHSA-qvrv-2x7x-78x2: Reflected XSS in SilverStripe
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user&amp;#39;s credentials or other sensitive user input.
CVSS v3.1: 6.1
GHSA-r6gq-v4qj-57vc: Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.1: 8.2
GHSA-48f2-r22m-c3xq: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet.
CVSS v3.1: 8.8
RHSA-2017:2192: Red Hat Security Advisory: mariadb security and bug fix update
mysql: Incorrect input validation allowing code execution via mysqldump mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016) mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017) mysql: Server: Charsets unspecified vulnerability (CPU Jan 2017) mysql: Server: DML unspecified vulnerability (CPU Jan 2017) mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) mysql: unsafe chmod/chown use in init script (CPU Jan 2017) mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) mysql: prepared statement handle use-after-free after disconnect mysql: Server: DML unspecified vulnerability (CPU Apr 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017) mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017) mysql: Logging unspecified vulnerability (CPU Jan 2017) mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) mysql: Server: DML unspecified vulnerability (CPU Apr 2017) mysql: Server: DDL unspecified vulnerability (CPU Apr 2017) mysql: Incorrect input validation allowing code execution via mysqldump mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017)
CVSS v3.0: 4.3
GHSA-f78q-mw55-hmg4: Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.
CVSS v3.1: 5.4
CVE-2007-0466: Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Properties_Object size field in a WMV file, which triggers memory corruption.
CVSS v2.0: 10
CVE-2009-4299: mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control, which allows attackers to read unauthorized Glossary entries via unknown vectors.
CVSS v2.0: 5
GHSA-76xp-j3hr-8ffv: The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.
CVSS v3.0: 8.8
GHSA-x89x-f37j-4hr4: Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.
CVSS v3.1: 9.8
CVE-2022-26383: When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
CVSS v3.1: 4.3
GHSA-qgr2-xgqv-24x8: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
CVSS v3.1: 7.8
CVE-2025-54019: WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.
CVSS v3.1: 6.5
CVE-2007-5791: The Vonage Motorola Phone Adapter VT 2142-VD does not properly verify that a SIP INVITE message originated from a legitimate server, which allows remote attackers to send spoofed INVITE messages, as demonstrated by a flood of messages triggering a denial of service, and by phone calls with malicious content.
CVSS v2.0: 10
CVE-2021-2064: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 9.8
CVE-2007-2830: The ath_beacon_config function in if_ath.c in MadWifi before 0.9.3.1 allows remote attackers to cause a denial of service (system crash) via crafted beacon interval information when scanning for access points, which triggers a divide-by-zero error.
CVSS v2.0: 5
GHSA-4hg6-gwcj-8xvf: In the Linux kernel, the following vulnerability has been resolved:fbdev: imxfb: Removed unneeded release_mem_regionRemove unnecessary release_mem_region from the error path to prevent
mem region from being released twice, which could avoid resource leak
or other unexpected issues.
CVSS v3.1: 5.5
CVE-2022-29127: BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
CVSS v3.1: 4.2
RHSA-2025:15358: Red Hat Security Advisory: updated RHEL-8 based Middleware Containers container images
Updated RHEL-8 based Middleware Containers container images are now available
cisco-sa-snort-dos-RywH7ezM: Multiple Cisco Products Snort Rule Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper handling of the Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. An attacker could exploit this vulnerability by sending a crafted IP packet to the affected device. A successful exploit could allow the attacker to cause through traffic to be dropped.

Note: Only products with Snort3 configured and either a rule with Block with Reset or Interactive Block with Reset actions configured are vulnerable. Products configured with Snort2 are not vulnerable.

Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.



This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see Cisco Event Response: October 2021 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74773"].
CVSS v3.1: 8.6
CVE-2025-69190: WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.
CVSS v3.1: 7.3
CVE-2019-7311: An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim's router. The admin password is stored in base64 cleartext in an "admin-auth" cookie. An attacker sniffing the network at the time of login could acquire the router's admin password. Alternatively, gaining physical access to the victim's computer soon after an administrative login could result in compromise.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2024-51820: WordPress L Squared Hub WP plugin <= 1.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wplsquared L Squared Hub WP l-squared-hub-wp-virtual-device allows SQL Injection.This issue affects L Squared Hub WP: from n/a through <= 1.0.
CVSS v3.1: 8.5
GHSA-9v4c-q3xh-jx9r: Subnet SolutionsPowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger an exception, resulting in a denial-of-service condition.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
CVE-2023-43302: An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVSS v3.1: 8.2
GHSA-g6gp-6q88-6j87: In the Linux kernel, the following vulnerability has been resolved:ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probeThis node pointer is returned by of_parse_phandle() with refcount
incremented in this function.
Calling of_node_put() to avoid the refcount leak.
CVSS v3.1: 5.5
CVE-2024-56061: WordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerability
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.
CVSS v3.1: 8.8
GHSA-84p7-rj74-5wp6: Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, or (3) login parameter.
GHSA-hff6-p675-x48v: libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
CVSS v3.1: 7.5
CVE-2022-50870: powerpc/rtas: avoid device tree lookups in rtas_os_term()
In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: avoid device tree lookups in rtas_os_term()

rtas_os_term() is called during panic. Its behavior depends on a couple
of conditions in the /rtas node of the device tree, the traversal of
which entails locking and local IRQ state changes. If the kernel panics
while devtree_lock is held, rtas_os_term() as currently written could
hang.

Instead of discovering the relevant characteristics at panic time,
cache them in file-static variables at boot. Note the lookup for
"ibm,extended-os-term" is converted to of_property_read_bool() since it
is a boolean property, not an RTAS function token.

[mpe: Incorporate suggested change from Nick]
GHSA-9wpj-h5jq-88p9: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVSS v3.1: 10
GHSA-4fqm-6fmh-82mq: OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login
SummaryOliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.DetailsThe issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.KillAction() authenticates the caller and applies only the per-action kill ACL check:service/internal/api/api.go:62However, it does not enforce the guest login requirement. The guest/login gate exists separately in:service/internal/api/api.go:474That gate is used by dashboard-style methods, but not by KillAction.In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:service/internal/config/sanitize.go:160Specifically:DefaultPermissions.View = falseDefaultPermissions.Exec = falseDefaultPermissions.Logs = falseDefaultPermissions.Kill remains unchangedAs a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():service/internal/acl/acl.go:133I validated this behavior on a clean 3000.10.2 setup:guests were denied access to GetDashboardan authenticated admin user started a long-running actionan unauthenticated guest successfully called KillActionthe action was terminatedThis confirms a real authorization bypass affecting action termination.PoCTested version:Create a minimal config:Start OliveTin 3000.10.2:Confirm the server is ready:Prove guests are blocked from dashboard access:Log in as admin:Start a long-running action as admin:Kill it as an unauthenticated guest:Observed response:Confirm in container logs:Observed relevant lines:This proves:guests are denied dashboard accessguests can still invoke KillActionthe running action is successfully terminated by an unauthenticated userImpactThis is an unauthenticated broken access control vulnerability resulting in denial of service.An unauthenticated guest can:terminate active jobs started by legitimate usersdisrupt long-running administrative or operational workflowsinterfere with privileged actions without being allowed to log inWho is impacted:OliveTin deployments with authRequireGuestsToLogin: truemulti-user environments where actions may run for meaningful durationsoperational environments where stopping a running action can interrupt maintenance, deployment, backup, or service-control tasksThis issue does not require valid credentials, only knowledge of a live executionTrackingId. That still makes it a real and exploitable availability issue in environments where execution identifiers can be observed or predicted
  through adjacent leaks or shared operator knowledge.
CVSS v3.1: 7.5
CVE-2017-8561: Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability".
CVSS v3.1: 7
CVSS v2.0: 6.9
GHSA-8868-2xhg-jv8v: Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSN3Y.
GHSA-vh6h-77mp-jg82: The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
CVSS v3.1: 7.5
CVE-2006-5247: Multiple cross-site scripting (XSS) vulnerabilities in Eazy Cart allow remote attackers to inject arbitrary web script or HTML via easycart.php, possibly related to the (1) des and (2) qty parameters in an add action, and via other unspecified vectors.  NOTE: some details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2024-2313: If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
CVSS v3.1: 2.8
GHSA-x748-g8vm-gmhw: The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.
CVSS v3.1: 4.3
GHSA-w5hh-7xrp-wmv3: Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 4.3
GHSA-j2c4-rr9q-8j5c: BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
CVSS v3.0: 9.8
CVE-2025-12134: ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable
The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attackers to enable/disable popups.
CVSS v3.1: 5.3
CVE-2012-4464: Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466.  NOTE: this issue might exist because of a CVE-2011-1005 regression.
CVSS v2.0: 5
RHSA-2011:1821: Red Hat Security Advisory: pidgin security update
(libpurple): Invalid UTF-8 string handling in OSCAR messages pidgin: Multiple NULL pointer deference flaws by processing certain Jingle stanzas in the XMPP protocol plug-in
GHSA-7vx4-68w6-mm4p: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, 6u60 and earlier, 5.0u51 and earlier, and Embedded 7u40 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.