ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-43625: A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthenticated remote attacker to perform DLL injection and execute arbitrary code in the context of the affected application process.
CVSS v3.1: 9.8
GHSA-477g-m6gf-5gg8: An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
CVSS v3.1: 6.7
GHSA-ggvq-2qg5-hr73: Cross-site scripting (XSS) vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in an order/order_print action to the default URI.
CVE-2018-18748: Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality
CVSS v3.0: 10
CVSS v2.0: 10
CVE-2024-10587: Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS v3.1: 8.8
GHSA-gm7j-87vp-cw43: NT OS Kernel Elevation of Privilege Vulnerability
CVSS v3.1: 7.4
GHSA-wmv4-5w76-vp9g: Authorization Bypass in Spring Security
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.MitigationUsers of affected versions should apply the following mitigation:Users of 3.2x should upgrade to 3.2.5 or laterUsers of 3.1.x should upgrade to 3.1.7 or laterCreditThis issue was identified by David Ohsie and brought to our attention by the CAS Development team.
CVSS v3.0: 9.8
GHSA-3hj6-89vp-w89r: Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.
CVSS v3.1: 8.8
CVE-2023-0922: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
CVSS v3.1: 5.9
CVE-2024-26789: crypto: arm64/neonbs - fix out-of-bounds access on short input
In the Linux kernel, the following vulnerability has been resolved:

crypto: arm64/neonbs - fix out-of-bounds access on short input

The bit-sliced implementation of AES-CTR operates on blocks of 128
bytes, and will fall back to the plain NEON version for tail blocks or
inputs that are shorter than 128 bytes to begin with.

It will call straight into the plain NEON asm helper, which performs all
memory accesses in granules of 16 bytes (the size of a NEON register).
For this reason, the associated plain NEON glue code will copy inputs
shorter than 16 bytes into a temporary buffer, given that this is a rare
occurrence and it is not worth the effort to work around this in the asm
code.

The fallback from the bit-sliced NEON version fails to take this into
account, potentially resulting in out-of-bounds accesses. So clone the
same workaround, and use a temp buffer for short in/outputs.
CVSS v3.1: 7.1
GHSA-fmw2-6w6r-r52f: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.
GHSA-x3rx-qh45-xr53: Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp and (2) content.asp.
RHSA-2013:0883: Red Hat Security Advisory: gnutls security update
gnutls: out of bounds read in _gnutls_ciphertext2compressed (GNUTLS-SA-2013-2)
RHSA-2004:240: Red Hat Security Advisory: squirrelmail security update
security flaw security flaw security flaw
GHSA-fm5g-pj4j-pr3h: Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler).
CVSS v3.1: 9.8
PYSEC-2023-151: An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter.
CVSS v3.1: 9.8
CVE-2008-6850: Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
CVE-2026-1286: CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.
CVSS v4.0: 7
GHSA-p77f-599h-qchc: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22638.
CVSS v3.0: 7.8
CVE-2011-1764: Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
CVSS v2.0: 7.5
CVE-2021-1843: This issue was addressed with improved checks. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-5j7h-7m92-jgh4: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.Users are recommended to upgrade to version 2.4.64, which fixes this issue.
CVSS v3.1: 7.5
CVE-2024-25903: WordPress Frontend File Manager Plugin plugin <= 22.7 - Sensitive Data Exposure vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7.
CVSS v3.1: 5.3
RHSA-2025:8058: Red Hat Security Advisory: kernel security update
kernel: vsock: Keep the binding until socket destruction
CVSS v3.1: 7.8
GHSA-q6hg-6m9x-5g9c: Evmos vulnerable to exploit of smart contract account and vesting
SummaryThis advisory board aims to describe two vulnerabilities found in the Evmos codebase:_Authorization check on the fundVestingAccount_: unauthorized spend of funds.DetailsAuthorization check on the fundVestingAccountWith the current implementation, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain.SeverityBased on [ImmuneFi Severity Classification System](https://immunefisupport.zendesk.com/hc/en-us/articles/13332717597585-Severity-Classification-System) the severity was evaluated to Critical since the attack could have lead to direct loss of funds.PatchesThe issue has been patched in versions >=V19.0.0
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-g2hj-qcr3-8fx6: Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-cx6w-8xmj-8g7f: Azure Stack Hub Spoofing Vulnerability
CVSS v3.1: 6.5
GHSA-g57h-5974-fhw4: The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
CVSS v3.1: 6.5
GHSA-7fh4-f65w-5p7x: Stack-based buffer overflow in D.R. Software Audio Converter 8.1, 2007, and 8.05 allows remote attackers to execute arbitrary code via a crafted pls playlist file.
CVE-2009-1294: Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.
CVSS v2.0: 4.3
GHSA-qg22-qxjf-9f4f: Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of arbitrary programs via by specifiying a malicious website argument to the Init method in (1) a certain ActiveX control (sysreqlab2.cab, sysreqlab.dll, sysreqlabsli.dll, or sysreqlab2.dll) and (2) a certain Java applet in RLApplet.class in sysreqlab2.jar or sysreqlab.jar.
CVE-2023-44758: GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
CVSS v3.1: 5.4
GHSA-h4gj-g96p-mj65: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.
CVSS v3.1: 9.8
GHSA-9gvp-359x-p74q: The my_skip_input_data_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
CVSS v3.0: 6.5
GHSA-fjrg-q598-j558: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The patch is named 33d9bb464353015aaaba84e27638ac9a3912795d. It is recommended to upgrade the affected component.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-49gg-c8j8-3j2c: Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that should not be allowed before they are admitted to the meeting.
CVSS v3.1: 4.3
CVE-2013-0647: Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0638.
CVSS v2.0: 10
GHSA-rmcj-gh5m-cc8v: Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
CVSS v3.1: 6.1
CVE-2014-1599: Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
CVSS v2.0: 4.3
GHSA-p435-prrh-xm57: In the Linux kernel, the following vulnerability has been resolved:io_uring/af_unix: disable sending io_uring over socketsFile reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.
CVSS v3.1: 4.7
CVE-2019-15895: search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-7g6x-pv6p-g248: WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1.
CVE-2026-9987: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)
CVSS v3.1: 7.8
CVE-2023-49775: WordPress CSV Importer Plugin <= 0.3.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Denis Kobozev CSV Importer.This issue affects CSV Importer: from n/a through 0.3.8.
CVSS v3.1: 4.3
GHSA-7xgc-mhcx-f3p4: A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
RHSA-2021:0885: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update
guava: local information disclosure via temporary directory created with unsafe permissions Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client undertow: Possible regression in fix for CVE-2020-10687 wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client
CVSS v3.1: 4.3
CVSS v3.0: 4.8
CVE-2000-1240: Unspecified vulnerability in siteman.php3 in AnyPortal(php) before 22 APR 00 allows remote attackers to obtain sensitive information via unknown attack vectors, which reveal the absolute path.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0: 5
CVE-2024-31178: Out-of-bounds Read in libfluid_msg library
Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::TableFeaturePropNextTables::unpack.

This issue affects libfluid: 0.1.0.
CVSS v3.1: 6.5
CVE-2024-0420: MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
CVSS v3.1: 6.1
GHSA-fh8v-v736-pf7m: Palm OS on Treo 650, 680, 700p, and 755p Smart phones allows remote attackers to cause a denial of service (device reset or hang) via a flood of large ICMP echo requests.  NOTE: this is probably a different vulnerability than CVE-2003-0293.
CVE-2023-27457: WordPress Add Expires Headers & Optimized Minify Plugin <= 2.7 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin <= 2.7 versions.
CVSS v3.1: 4.3
RHSA-2017:2479: Red Hat Security Advisory: httpd security update
httpd: ap_get_basic_auth_pw() authentication bypass httpd: mod_ssl NULL pointer dereference httpd: ap_find_token() buffer overread httpd: mod_mime buffer overread httpd: Uninitialized memory reflection in mod_auth_digest
CVSS v3.0: 4.8
CVE-2019-8339: An issue was discovered in Falco through 0.14.0. A missing indicator for insufficient resources allows local users to bypass the detection engine.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-hj7j-4p8c-xgw6: The default stylesheet for DocBook on Red Hat Linux 6.2 through 7.2 is installed with an insecure option enabled, which could allow users to overwrite files outside of the current directory from an untrusted document by using a full pathname as an element identifier.
GHSA-86wp-278v-h7vp: Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter.
GHSA-58gh-w9m3-2whq: Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
GHSA-x9gq-5263-4j37: Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php.
GHSA-p9jg-9w87-6rg4: TYPO3 Improper Access Management in the File Abstraction Layer
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.
GHSA-92wr-j974-xw8j: RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key.
CVSS v3.1: 5.9
GHSA-h8vm-65gc-gw46: IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.
CVSS v3.1: 5.9
CVE-2022-29851: documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
CVSS v3.1: 9.8
CVE-2019-9699: Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
CVSS v3.1: 4.5
CVSS v2.0: 2.7
RHSA-2022:0273: Red Hat Security Advisory: polkit security update
polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
CVSS v3.1: 7.8
CVE-2025-38110: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
In the Linux kernel, the following vulnerability has been resolved:

net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

When using publicly available tools like 'mdio-tools' to read/write data
from/to network interface and its PHY via C45 (clause 45) mdiobus,
there is no verification of parameters passed to the ioctl and
it accepts any mdio address.
Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
but it is possible to pass higher value than that via ioctl.
While read/write operation should generally fail in this case,
mdiobus provides stats array, where wrong address may allow out-of-bounds
read/write.

Fix that by adding address verification before C45 read/write operation.
While this excludes this access from any statistics, it improves security of
read/write operation.
CVSS v3.1: 7.1
CVE-2018-7092: A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remotely exploited to allow for remote directory traversal leading to arbitrary file deletion.
CVSS v3.0: 7.5
CVSS v2.0: 6.4
GHSA-5985-x66x-p86v: A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
GHSA-fh5w-p2j4-4p8x: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin
Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.
CVSS v3.1: 4.3
GHSA-89hp-893v-jcmm: Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to only have access to DBSec data in the Insights Server.
GHSA-c9vr-xfpq-q5qc: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.