ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-q8xg-8xwf-m598: Machine-In-The-Middle in lix
All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.RecommendationNo fix is currently available. Consider using an alternative package until a fix is made available.
CVSS v3.1: 8.1
CVE-2011-1313: Double free vulnerability in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote backend IIOP servers to cause a denial of service (S0C4 ABEND and storage corruption) by rejecting IIOP requests at opportunistic time instants, as demonstrated by requests associated with an ORB_Request::getACRWorkElementPtr function call.
CVSS v2.0: 5
GHSA-x9rq-9gxv-4m5h: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
GHSA-hcrv-8mmq-xp49: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.This issue affects Woocommerce Support System: from n/a through 1.2.1.
CVSS v3.1: 9.8
CVE-2017-10164: Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FSCM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FSCM accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 4.3
CVSS v2.0: 4
RHSA-2009:0362: Red Hat Security Advisory: NetworkManager security update
NetworkManager: GetSecrets disclosure
CVE-2000-0043: Buffer overflow in CamShot WebCam HTTP server allows remote attackers to execute commands via a long GET request.
CVSS v2.0: 7.5
CVE-2023-28990: WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability
Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.
CVSS v3.1: 4.3
CVE-2011-2365: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2364.
CVSS v2.0: 10
CVE-2020-1319: Microsoft Windows Codecs Library Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p>
<p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>
CVSS v3.1: 7.3
GHSA-p3w4-3pq3-x7jm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erik Saulnier News Articles allows Stored XSS.This issue affects News Articles: from n/a through 1.0.0.
CVSS v3.1: 6.5
CVE-2026-24270: NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS v3.1: 9.8
RHSA-2013:0148: Red Hat Security Advisory: openshift-origin-node-util security update
openshift-origin-node-util: restorer.php preg_match shell code injection openshift-origin-node-util: restorer.php arbitrary URL redirection
GHSA-mf4v-53v8-r6cm: The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy.
CVE-2024-33552: WordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability
Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8.
CVSS v3.1: 9.8
CVE-2023-49549: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
CVSS v3.1: 7.5
CVE-2019-10416: Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-3qq3-668m-v9mj: Gogs has a Denial of Service in repository/wiki file listing web pages
SummaryA malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki.DetailsThe issue is present in file `internal/route/repo/wiki.go` and `internal/route/repo/view.go` where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service.
In `view.go` the issue occurs at [line 56](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/view.go#L56) while a slightly different issue occurs in `wiki.go` at [line 174](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/wiki.go#L174) where `commits[0]` is dereferenced without checking if it contains value.
It is possible to trigger issues in assigning the correct value to variable `commits` by using a specific string as part of the page title. 
The issue is linked to the fact that file names can contain special characters such as `*`, `?`, `[`, `]`, etc. that will be interpreted as git's pathspec instead of a simple string. So crafting a name containing an incomplete pathspec sequence will trigger this error.PoCAs a proof of concept consider the file name `"[]` and how it affects repository and wiki pages.
In the following images it is shown how pages are created, the error shown in the web page right after creation and the error as logged in the console.**Figure 1: Creation of malicious file in repository****Figure 2: Malicious file in repository causes error 500****Figure 3: Console error caused by malicious file in repository****Figure 4: Creation of malicious file in wiki****Figure 5: Malicious file in wiki causes error 500****Figure 6: Console error caused by malicious file in wiki**ImpactThe repository and wiki pages will not render when files named with the payload are present in the repository or in the wiki.
This condition will be present as long as the malicious file is present in the repository or wiki. The issue will not cause a DoS condition when using the server via CLI.
CVSS v3.1: 4.9
CVE-2020-15623: This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722.
CVSS v3.0: 9.8
GHSA-rfmj-78j3-h4xf: The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.
CVSS v3.1: 9.8
CVE-2016-0442: Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Loader Service.
CVSS v2.0: 6.5
GHSA-4w8h-2hjm-3r6x: Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved for the first time, which allows remote attackers to gain unauthorized access via the new account before it is saved.
GHSA-6fm7-6gxw-jhxx: Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App Password Protection feature.
RHSA-2024:7261: Red Hat Security Advisory: osbuild-composer security update
encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion
CVSS v3.1: 7.5
CVE-2024-34057: Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer overflow can cause a crash, resulting in a denial of service.
CVSS v3.1: 8.2
CVE-2023-41932: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
CVSS v3.1: 6.5
GHSA-6x3h-jq42-qq24: Missing Authorization vulnerability in Astoundify Jobify - Job Board WordPress Theme.This issue affects Jobify - Job Board WordPress Theme: from n/a through 4.2.3.
CVSS v3.1: 5.3
CVE-2020-4674: IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287.
CVSS v3.0: 4.3
CVE-2025-8640: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26263.
CVSS v3.0: 6.8
GHSA-jww8-f62q-7957: Cross-site scripting (XSS) vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary script as other users by injecting arbitrary script into the z parameter.
CVE-2014-2282: The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.
CVSS v2.0: 4.3
CVE-2023-24124: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
CVSS v3.1: 6.5
GHSA-25vh-j698-43q9: In the Linux kernel, the following vulnerability has been resolved:tty: serial: fsl_lpuart: fix race on RX DMA shutdownFrom time to time DMA completion can come in the middle of DMA shutdown:<process ctx>:				<IRQ>:
lpuart32_shutdown()
  lpuart_dma_shutdown()
    del_timer_sync()
					lpuart_dma_rx_complete()
					  lpuart_copy_rx_to_tty()
					    mod_timer()
    lpuart_dma_rx_free()When the timer fires a bit later, sport->dma_rx_desc is NULL:Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
pc : lpuart_copy_rx_to_tty+0xcc/0x5bc
lr : lpuart_timer_func+0x1c/0x2c
Call trace:
 lpuart_copy_rx_to_tty
 lpuart_timer_func
 call_timer_fn
 __run_timers.part.0
 run_timer_softirq
 __do_softirq
 __irq_exit_rcu
 irq_exit
 handle_domain_irq
 gic_handle_irq
 call_on_irq_stack
 do_interrupt_handler
 ...To fix this fold del_timer_sync() into lpuart_dma_rx_free() after
dmaengine_terminate_sync() to make sure timer will not be re-started in
lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().
CVSS v3.1: 4.7
CVE-2026-32488: WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in wpeverest User Registration user-registration allows Privilege Escalation.This issue affects User Registration: from n/a through <= 4.4.9.
CVSS v3.1: 8.1
CVE-2023-36627: FlashBlade Snapshot Scheduler
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly. 

CVSS v3.1: 7.7
CVE-2019-16539: A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
CVSS v3.1: 6.5
CVSS v2.0: 5.5
GHSA-jvwx-cqx2-8qq4: A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.                                                                                                                                                                                              Other related CVE's are CVE-2025-14096 and CVE-2025-14097.Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.Required configuration for Exposure: Physical access to the analyzer is needed.Temporary work Around:Only authorized people can physically access the analyzer.Permanent solution:
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.                                    
Exploit Status:                                                                                                                                                                                                                                                                                                                                                                                      
Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.
CVSS v3.1: 6.8
CVE-2019-12312: In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-h83h-p79w-q64j: A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5. An app may be able to read sensitive location information.
CVSS v3.1: 9.8
CVE-2011-3535: Unspecified vulnerability in the Solaris component in Oracle Sun Products Suite 8, 9, 10, and 11 Express allows remote attackers to affect availability via unknown vectors related to Remote Quota Server (rquotad).
CVSS v2.0: 5
GHSA-h535-v6v7-r4q9: The go-gnome Helix GNOME pre-installer allows local users to overwrite arbitrary files via a symlink attack on various files in /tmp, including uudecode, snarf, and some installer files.
CVE-2014-10037: Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url parameter to photoalbum/index.php.
CVSS v2.0: 7.5
CVE-2021-22028: In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure from the file system. A malicious user can read/write information from the file system using this vulnerability.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-m9rg-r5q5-gv65: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).
CVSS v3.0: 8.3
CVE-2020-25636: A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
CVSS v3.1: 6.6
GHSA-p38r-qw8r-84c4: The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
CVSS v3.0: 5.5
GHSA-j96m-mjp6-99xr: ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
SummarySpecially crafted SVG file make segmentation fault and generate trash files in "/tmp", possible to leverage DoS.Operating system, version and so onLinux,  Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara)Tested ImageMagick version6.9.11-60, 7.1.0-62DetailsA specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.It seems that this error affects a lot of websites and causes a generating trash files in ```/tmp``` when uploading this PC file to the server.I think it's better to check the file descriptor coming from itself before executing ```read()```.PoCGenerate SVG file:Run some commands for verification:ImpactPossible DOS, because when ImageMagick crashes it generates a lot of trash files. This trash file can be large, if SVG file contains many render action.Additional impactIn DOS attack if remount attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. This means that if an attacker uploads a 100 M SVG, the server will generate about 10 G.Example:P. S. If ImageMagick will work in Docker container this attack will crash server where docker running. Because the size of the docker container will increase.
CVSS v3.1: 5.5
GHSA-6q3p-36f4-cwxv: Server-Side Request Forgery in UReport
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
CVE-2026-36045: picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.
CVSS v3.1: 7.3
CVE-2022-33269: Integer overflow or wraparound in Core
Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
CVSS v3.1: 9.3
GHSA-x5cf-h7c6-p7f8: Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code.
RHSA-2011:0856: Red Hat Security Advisory: java-1.6.0-openjdk security update
OpenJDK: integer overflows in JPEGImageReader and font SunLayoutEngine (2D, 7013519) OpenJDK: JVM memory corruption via certain bytecode (HotSpot, 7020373) OpenJDK: Deserialization allows creation of mutable SignedObject (Deserialization, 6618658) OpenJDK: NetworkInterface information leak (Networking, 7013969) OpenJDK: incorrect numeric type conversion in TransformHelper (2D, 7016495) OpenJDK: unprivileged proxy settings change via SOAPConnection (SAAJ, 7013971) OpenJDK: MediaTracker created Component instances with unnecessary privileges (Swing, 7020198)
GHSA-x48r-46h4-7m6p: Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS v3.0: 6.1
CVE-2024-0906: f(x) Private Site <= 1.2.1 - Sensitive Information Exposure
The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the API. This makes it possible for unauthenticated attackers to obtain page and post contents of a site protected with this plugin.
CVSS v3.1: 5.3
GHSA-jjx3-pqc8-56r8: An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
CVSS v3.1: 9.8
GHSA-prfm-p99w-7gm2: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks.
CVSS v3.1: 6.5
CVE-2005-3356: The mq_open system call in Linux kernel 2.6.9, in certain situations, can decrement a counter twice ("double decrement") as a result of multiple calls to the mntput function when the dentry_open function call fails, which allows local users to cause a denial of service (panic) via unspecified attack vectors.
CVSS v2.0: 2.1
CVE-2015-7579: Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2020-9467: Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2025-2603: SourceCodester Kortex Lite Advocate Office Management System deactivate.php sql injection
A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the file deactivate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2010-4324: Cross-site scripting (XSS) vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3