ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-43cq-c2gq-pfpw: Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
SummaryThe `EntriesController::actionMoveToSection()` endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.DetailsThe vulnerable route is implemented in [EntriesController.php](/D:/files/projects/cms-5.9.19/cms-5.9.19/src/controllers/EntriesController.php):465:The destination check is only `viewEntries:$section->uid` . The source-entry gate is `Entry::canMove()`, which verifies whether the user can move the existing entry based on the source section:This closes the exploit chain:External source: authenticated CP request to `entries/move-to-section`.Missing authorization check: destination section requires only `viewEntries`, not `saveEntries`.Privileged sink: `moveEntryToSection()` rewrites `sectionId` and saves the entry into the unauthorized section.Preconditions derived from the code:The attacker is authenticated to the control panel.Entry `345` is movable by the attacker from its current section.The attacker can satisfy `viewEntries` on destination section `12`.The attacker does not have `saveEntries:DESTINATION_UID`, which is the missing check that makes the bypass possible.Result:The controller accepts the request because `viewEntries:$section->uid` passes.Each source entry passes `canMove()` based on source-section permissions.`moveEntryToSection()` updates the entry’s `sectionId` and saves it.The entry is now located in a section where the attacker did not have write permission.ImpactThis breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.
CVSS v4.0: 6
GHSA-5xrp-6693-jjx9: n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime.An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations.
CVSS v3.1: 9.9
CVE-2024-49549: InDesign Desktop | Out-of-bounds Read (CWE-125)
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-cmv4-w733-w8cj: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS v3.1: 6.1
GHSA-9p83-qxxf-6fm5: , aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17121.
CVSS v3.1: 8.1
GHSA-rw74-vc9h-534j: Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
SummarySeveral administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because `SameSite=Lax` cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page.DetailsIn `modules/preferences.php`, the `backup`, `test_email`, and `htaccess` modes accept GET parameters with no CSRF token check:The `save` mode in the same file validates CSRF via `getFormObject()`, confirming the developers intended CSRF protection but did not apply it to these other modes.Because these are GET requests, `SameSite=Lax` browsers include session cookies on top-level cross-origin navigations, making CSRF exploitation trivial.Proof of ConceptSimplified attacker page (`csrf.html` hosted on attacker origin):When an administrator visits this page, the browser navigates to the Admidio backup URL with full session cookies. The server generates a database dump and serves it as a download to the victim's browser. Note: the backup downloads to the victim's machine, not to the attacker. The attacker cannot read the response cross-origin.For `htaccess` mode, the CSRF overwrites the `.htaccess` file on the server, disrupting the application. For `test_email` mode, it triggers email sends from the server, which an attacker can abuse for spam or to probe internal email infrastructure.ImpactAn attacker tricks an Admidio administrator into visiting a malicious page that triggers state-changing operations on the server:**Backup creation**: forces the server to generate a full database dump. The backup downloads to the victim's browser, not to the attacker. However, repeated backup triggers can cause disk I/O and storage pressure on the server.**htaccess modification**: overwrites the server's `.htaccess` file, breaking URL routing or disabling security headers.**Test email**: fires email sends from the server, usable as a spam relay or to probe internal mail configuration.The core issue is that state-changing operations run via unprotected GET requests. The victim only needs to visit a single attacker-controlled page while logged in.Recommended FixChange `backup`, `test_email`, and `htaccess` operations to require POST requests.Add CSRF token validation using the existing `getFormObject()` mechanism.As defense in depth, set `SameSite=Strict` on session cookies or add a confirmation step for destructive operations like database backup.*Found by [aisafe.io](https://aisafe.io)*
CVSS v3.1: 3.5
GHSA-r798-qx7r-v3gw: Jenkins Octopus Deploy Plugin stores credentials in plain text
Jenkins Octopus Deploy Plugin stores credentials unencrypted in its global configuration file `hudson.plugins.octopusdeploy.OctopusDeployPlugin.xml` on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
CVSS v3.0: 3.3
GHSA-vq53-fvjx-3c2c: Microsoft Internet Explorer 4.0 through 6.0 could allow local users to differentiate between alphanumeric and non-alphanumeric characters used in a password by pressing certain control keys that jump between non-alphanumeric characters, which makes it easier to conduct a brute-force password guessing attack.
GHSA-c5w2-37ff-8942: PHP remote file inclusion vulnerability in admin/index.php in DreamAccount 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVE-2022-24834: Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
CVSS v3.1: 7
GHSA-cw5v-74xv-hcxg: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol.
GHSA-r5j3-c4vg-xf85: The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.
CVSS v3.1: 5.4
CVE-2025-4374: Quay: incorrect privilege assignment
A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.
CVSS v3.1: 6.5
GHSA-34fq-w3c7-7c97: Skia, as used in Google Chrome before 18.0.1025.151, does not properly perform clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
GHSA-vh58-x7x5-79rq: Some futex functions in futex.c for Linux kernel 2.6.x perform get_user calls while holding the mmap_sem semaphore, which could allow local users to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions.
GHSA-cv9x-mgf7-jrm6: The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
GHSA-g28c-hcr7-j2fw: Missing Authorization vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AMP for WP: from n/a through 1.0.96.1.
CVSS v3.1: 6.3
CVE-2011-2297: Unspecified vulnerability in Oracle Solaris Cluster 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Data Service for WebLogic Server.
CVSS v2.0: 6.1
CVE-2023-52597: KVM: s390: fix setting of fpc register
In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: fix setting of fpc register

kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control
(fpc) register of a guest cpu. The new value is tested for validity by
temporarily loading it into the fpc register.

This may lead to corruption of the fpc register of the host process:
if an interrupt happens while the value is temporarily loaded into the fpc
register, and within interrupt context floating point or vector registers
are used, the current fp/vx registers are saved with save_fpu_regs()
assuming they belong to user space and will be loaded into fp/vx registers
when returning to user space.

test_fp_ctl() restores the original user space / host process fpc register
value, however it will be discarded, when returning to user space.

In result the host process will incorrectly continue to run with the value
that was supposed to be used for a guest cpu.

Fix this by simply removing the test. There is another test right before
the SIE context is entered which will handles invalid values.

This results in a change of behaviour: invalid values will now be accepted
instead of that the ioctl fails with -EINVAL. This seems to be acceptable,
given that this interface is most likely not used anymore, and this is in
addition the same behaviour implemented with the memory mapped interface
(replace invalid values with zero) - see sync_regs() in kvm-s390.c.
CVSS v3.1: 4
CVE-2019-18615: In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. This only affects CVP environments where: 1. Devices have enable mode passwords which are different from the user's login password, OR 2. There are configlet builders that use the Device class and specify username and password explicitly Application logs are not accessible or visible from the CVP GUI. Application logs can only be read by authorized users with privileged access to the VM hosting the CVP application.
CVSS v3.1: 4.9
CVSS v2.0: 3.5
GHSA-2jv3-8jp8-xgcm: Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.
CVSS v3.1: 7.1
GHSA-5wfp-8643-c58x: Improper Input Validation in Apache POI
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2024-32303: Tenda AC15 v15.03.20_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
CVSS v3.1: 8
GHSA-h34f-cf95-vh44: An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution.
RHSA-2023:1436: Red Hat Security Advisory: nss security update
nss: Arbitrary memory write via PKCS 12
CVSS v3.1: 8.8
CVE-2022-41076: PowerShell Remote Code Execution Vulnerability
PowerShell Remote Code Execution Vulnerability
CVSS v3.1: 8.5
GHSA-2934-h34j-g33x: Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via the staff_list parameter in the index.php component.
CVSS v3.1: 6.5
CVE-2024-37031: The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
CVSS v3.1: 6.1
RHSA-2020:3539: Red Hat Security Advisory: Red Hat build of Thorntail 2.7.1 security and bug fix update
EAP: field-name is not parsed in accordance to RFC7230 keycloak: security headers missing on REST endpoints Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain hibernate-validator: Improper input validation in the interpolation of constraint error messages wildfly-elytron: session fixation when using FORM authentication wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API wildfly: unsafe deserialization in Wildfly Enterprise Java Beans keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body wildfly: Some EJB transaction objects may get accumulated causing Denial of Service wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
CVSS v3.1: 6.5
GHSA-qr63-7ppg-q2f9: A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2023-5448: WP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Reset
The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link.
CVSS v3.1: 8.8
CVE-2026-28287: FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
CVSS v4.0: 8.6
CVE-2015-5185: The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty className in a packet.
CVSS v2.0: 5
CVE-2022-39862: Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascript interface api.
CVSS v3.1: 5.3
GHSA-22f2-jv6w-6ggr: Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.
CVSS v3.1: 4.3
GHSA-fx3g-pqv9-p53f: com.apple.AppleDiskImageController in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via a malformed DMG image that triggers memory corruption.  NOTE: the severity of this issue has been disputed by a third party, who states that the impact is limited to a denial of service (kernel panic) due to a vm_fault call with a non-aligned address.
GHSA-pccv-hggp-8h3q: Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2023-37946: Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.
CVSS v3.1: 8.8
GHSA-hgwx-v3w7-cwj6: Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3, as used in CA (Computer Associates) products including eTrust Secure Content Manager r8 on Windows, allow remote attackers to execute arbitrary code via unknown vectors.
GHSA-qh6r-59h6-h73r: A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init_runit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object.
GHSA-45pp-w4rj-fj8v: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS v3.1: 5.5
CVE-2024-57992: wifi: wilc1000: unregister wiphy only if it has been registered
In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: unregister wiphy only if it has been registered

There is a specific error path in probe functions in wilc drivers (both
sdio and spi) which can lead to kernel panic, as this one for example
when using SPI:

Unable to handle kernel paging request at virtual address 9f000000 when read
[9f000000] *pgd=00000000
Internal error: Oops: 5 [#1] ARM
Modules linked in: wilc1000_spi(+) crc_itu_t crc7 wilc1000 cfg80211 bluetooth ecdh_generic ecc
CPU: 0 UID: 0 PID: 106 Comm: modprobe Not tainted 6.13.0-rc3+ #22
Hardware name: Atmel SAMA5
PC is at wiphy_unregister+0x244/0xc40 [cfg80211]
LR is at wiphy_unregister+0x1c0/0xc40 [cfg80211]
[...]
 wiphy_unregister [cfg80211] from wilc_netdev_cleanup+0x380/0x494 [wilc1000]
 wilc_netdev_cleanup [wilc1000] from wilc_bus_probe+0x360/0x834 [wilc1000_spi]
 wilc_bus_probe [wilc1000_spi] from spi_probe+0x15c/0x1d4
 spi_probe from really_probe+0x270/0xb2c
 really_probe from __driver_probe_device+0x1dc/0x4e8
 __driver_probe_device from driver_probe_device+0x5c/0x140
 driver_probe_device from __driver_attach+0x220/0x540
 __driver_attach from bus_for_each_dev+0x13c/0x1a8
 bus_for_each_dev from bus_add_driver+0x2a0/0x6a4
 bus_add_driver from driver_register+0x27c/0x51c
 driver_register from do_one_initcall+0xf8/0x564
 do_one_initcall from do_init_module+0x2e4/0x82c
 do_init_module from load_module+0x59a0/0x70c4
 load_module from init_module_from_file+0x100/0x148
 init_module_from_file from sys_finit_module+0x2fc/0x924
 sys_finit_module from ret_fast_syscall+0x0/0x1c

The issue can easily be reproduced, for example by not wiring correctly
a wilc device through SPI (and so, make it unresponsive to early SPI
commands). It is due to a recent change decoupling wiphy allocation from
wiphy registration, however wilc_netdev_cleanup has not been updated
accordingly, letting it possibly call wiphy unregister on a wiphy which
has never been registered.

Fix this crash by moving wiphy_unregister/wiphy_free out of
wilc_netdev_cleanup, and by adjusting error paths in both drivers
CVSS v3.1: 5.5
CVE-1999-0252: Buffer overflow in listserv allows arbitrary command execution.
CVSS v2.0: 7.5
CVE-2015-0669: The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 15.4S and 15.4(3)S allows remote attackers to modify configuration settings or cause a denial of service (partial service outage) by sending crafted Autonomic Networking (AN) messages on an intranet network, aka Bug ID CSCup62167.
CVSS v2.0: 6.4
PYSEC-2022-43028: The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.
RHSA-2025:11533: Red Hat Security Advisory: git security update
git: Git does not sanitize URLs when asking for credentials interactively git: Newline confusion in credential helpers can lead to credential exfiltration in git gitk: Git file creation flaw gitk: git script execution flaw git: Git GUI can create and overwrite files for which the user has write permission git: Git arbitrary code execution git: Git arbitrary file writes
CVSS v3.1: 8.3
CVE-2023-39365: Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1: 4.6
RHSA-2025:23079: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)
ray: Ray Job Submission Arbitrary Code Execution libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise libssh: out-of-bounds read in sftp_handle() vllm: Server Side request forgery (SSRF) in MediaConnector sqlite: Integer Truncation in SQLite libtiff: LibTIFF Use-After-Free Vulnerability openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap libtiff: Libtiff Write-What-Where golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh runc: container escape with malicious config due to /dev/console mount and related races vim: Vim path traversial vim: Vim path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack starlette: Starlette DoS via Range header merging vllm: vLLM: Remote Code Execution via malicious model configuration
CVSS v3.1: 7.5
GHSA-ghpw-rc8r-24wc: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is Clipboard access in the lockscreen state via a physical keyboard. The Samsung ID is SVE-2018-12684 (October 2018).
GHSA-7ccg-jm7j-4f8v: Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.
CVSS v3.1: 8.1