ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vfm6-r2gc-pwww: Symfony2 security issue when the trust proxy mode is enabled
An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control.To fix this security issue, the following changes have been made to all versions of Symfony2:A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument:The Request::trustProxyData() method has been deprecated (when used, it automatically trusts the latest proxy in the chain -- which is the current remote address):We encourage all Symfony2 users to upgrade as soon as possible. It you don't want to upgrade to the latest version yet, you can also apply the following patches:[Patch](https://github.com/symfony/symfony/compare/fc89d6b...9ce892c.patch) for Symfony 2.0.19[Patch](https://github.com/symfony/symfony/compare/922c201...e5536f0.patch) for Symfony 2.1.4
ICSA-23-026-05: Mitsubishi Electric MELFA SD/SQ series and F-series Robot Controllers
An authentication bypass vulnerability due to active debug code exists in Mitsubishi Electric MELFA SD/SQ series and F-series controllers for industrial robots. An attacker could gain unauthorized access to a robot controller by performing an unauthorized telnet login.-CVE-2022-33323 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.0: 7.5
CVE-2015-5363: The SRX Network Security Daemon (nsd) in Juniper SRX Series services gateways with Junos 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 allows remote DNS servers to cause a denial of service (crash) via a crafted DNS response.
CVSS v2.0: 5
GHSA-wg74-2782-fg3q: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gonzalo Geraldo Adventure Bucket List allows DOM-Based XSS.This issue affects Adventure Bucket List: from n/a through 1.0.9.
CVSS v3.1: 6.5
GHSA-qh2p-m2fc-fmj6: The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.
CVE-2026-3940: Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 4.3
CVE-2021-44278: Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-qj6m-vqpr-wffx: Improper privilege management during pre-MFA cookie handling in Devolutions Server 2025.3.5.0 and earlier allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.
CVSS v3.1: 8.8
GHSA-rqh4-x2v7-j34g: A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
CVSS v3.1: 5.5
GHSA-x6wp-j99g-7m6h: Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVSS v3.1: 7.8
CVE-2023-0012: Local Privilege Escalation in SAP Host Agent (Windows)
In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAP_LocaAdmin are denied the ability to logon locally by security policy so that this can only occur if the system has already been compromised.
CVSS v3.1: 6.4
GHSA-jw79-3rh8-v6jv: Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated
remote attacker to retrieve sensitive information about the device via HTTP requests.
CVSS v3.1: 7.5
CVE-2023-50301: IBM Transformation Extender Advanced information disclosure
IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user.
CVSS v3.1: 1.9
CVE-2020-15323: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2015-5060: Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-pwwj-2c24-8cvr: An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
CVSS v3.1: 7.5
GHSA-7ghf-82mv-88qr: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18910.
CVSS v3.0: 7.8
GHSA-jxmx-pcj9-cjqp: Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files.
CVE-2000-1057: Vulnerabilities in database configuration scripts in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows local users to gain privileges, possibly via insecure permissions.
CVSS v2.0: 4.6
RHSA-2025:14869: Red Hat Security Advisory: postgresql security update
postgresql: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table postgresql: PostgreSQL code execution in restore operation postgresql: PostgreSQL executes arbitrary code in restore operation
CVSS v3.1: 8.8
CVE-2025-23769: WordPress Content Mirror plugin <= 1.2 -  Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through <= 1.2.
CVSS v3.1: 7.1
CVE-2023-33263: In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006.
CVSS v3.1: 7.5
CVE-2018-2679: Vulnerability in the Oracle Financial Services Profitability Management component of Oracle Financial Services Applications (subcomponent: User Interface). Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Profitability Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Profitability Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Profitability Management accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0: 8.1
CVSS v2.0: 5.5
CVE-2022-49384: md: fix double free of io_acct_set bioset
In the Linux kernel, the following vulnerability has been resolved:

md: fix double free of io_acct_set bioset

Now io_acct_set is alloc and free in personality. Remove the codes that
free io_acct_set in md_free and md_stop.
CVSS v3.1: 7.8
GHSA-x8v9-9fhc-8v9r: Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.  NOTE: this issue might be a duplicate of CVE-2007-0177.
GHSA-v6cc-28f6-mj2q: Ocean12 Membership Manager Pro stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to o12member.mdb.
CVE-2014-9746: The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2014-0378: Unspecified vulnerability in the Spatial component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v2.0: 4.1
GHSA-xg5r-8j97-2wrj: Directory Traversal in restafary
Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.Proof of ConceptRecommendationUpdate to version 1.6.1 or later.
GHSA-57pf-f69p-p222: A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVSS v3.1: 9.8
CVE-2021-20506: IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.
CVSS v3.0: 5.4
CVE-2007-3981: SQL injection vulnerability in index.php in WSN Links Basic Edition allows remote attackers to execute arbitrary SQL commands via the catid parameter in a displaycat action.
CVSS v2.0: 7.5
CVE-2008-3067: sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.
CVSS v2.0: 2.1
GHSA-p83g-vrrg-rq2w: HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.
CVSS v3.1: 3.5
GHSA-hwch-749c-rv63: Potential Command Injection in hubot-scripts
Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module.Mitigating FactorsThe email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.RecommendationUpdate hubot-scripts to version 2.4.4 or later.
CVSS v3.1: 9.8
CVE-2010-4682: Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to cause a denial of service (memory consumption) by making multiple incorrect LDAP authentication attempts, aka Bug ID CSCtf29867.
CVSS v2.0: 7.8
ICSA-14-058-01: Schneider Electric Floating License Manager Vulnerability
Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
CVE-2023-40621: Code Injection vulnerability in SAP PowerDesigner Client
SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
CVSS v3.1: 6.3
GHSA-8pqj-vj9j-2jf2: Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.
GHSA-m469-jmc4-66pp: Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 9.8
GHSA-jv68-xw7p-xh9p: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM - LDAP user and role Synch). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Identity Manager accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1: 7.5
CVE-2015-8804: x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2018-18886: Helpy v2.1.0 has Stored XSS via the Ticket title.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-8wcw-rggr-6844: SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.
CVE-2025-12675: KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all versions up to, and including, 1.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's config.
CVSS v3.1: 4.3
GHSA-x855-4m6r-jwmr: A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID (sess_id) can send specially crafted POST requests to the /json endpoint, enabling arbitrary command execution on the underlying system. This vulnerability can lead to full system compromise, including unauthorized access, privilege escalation, and potentially full device takeover.
CVSS v3.1: 7.2
GHSA-gm9m-gwc4-hwgp: Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
Summary`@fedify/fedify` follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection. An attacker who controls a remote ActivityPub key or actor URL can force a server using Fedify to make repeated outbound requests from a single inbound request, leading to resource consumption and denial of service.DetailsFedify verifies ActivityPub HTTP signatures by fetching the remote `keyId` during request processing. The relevant flow is `handleInboxInternal()` -> `verifyRequest()` -> `fetchKeyInternal()` -> document loader.In affected versions:the generic document loader recursively follows `3xx` responses by calling `load()` again on the `Location` headerthe authenticated redirect path (`doubleKnock()`) also recursively follows redirectsneither path enforces a redirect cap or tracks visited URLs to detect self-referential redirect loopsAs a result, if an attacker-controlled `keyId` or actor URL responds with `302 Location: <same URL>`, a single ActivityPub request can trigger tens or hundreds of outbound requests before the fetch completes or the request times out.I confirmed the issue in `@fedify/fedify` 1.9.1 and 1.9.2. By contrast, Fedify's WebFinger lookup path already has a redirect cap, which suggests the missing bound in the document loader is unintended.Failed key fetches are not durably negatively cached. After a failed lookup, the null result is only remembered in a request-local cache, so later requests can trigger the same redirect loop again for the same `keyId`.PoCMinimal direct reproduction with the package:Install `@fedify/fedify@1.9.2`.Save and run the following script:Observe output similar to:This shows the loader followed 119 self-redirects before the first non-redirect response.The authenticated loader used for signed requests shows the same behavior:ImpactThis is an unauthenticated denial-of-service / request amplification issue. Any Fedify-based server that verifies remote keys or loads remote ActivityPub documents can be forced to spend CPU time, worker time, connection slots, and outbound bandwidth following attacker-controlled redirects. A single inbound request can trigger a large number of outbound requests, and the attack can be repeated across requests because failed lookups are not durably negatively cached.Misc NotesThis issue was surfaced by a Ghost ActivityPub user reporting the issue directly to Ghost. The above report was generated upon further investigation into the issue by the Ghost team. We credit @wrathsec for the discovery.
CVSS v3.1: 7.5
CVE-2023-23997: WordPress Database Collation Fix Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.
CVSS v3.1: 4.3
CVE-2025-20028: Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0: 7.1
CVE-2008-3613: Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving a search for a remote disk on the local network.
CVSS v2.0: 6.1
CVE-2024-51842: WordPress Image Carousel Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Image Carousel Shortcode image-carousel-shortcode allows DOM-Based XSS.This issue affects Image Carousel Shortcode: from n/a through <= 1.2.
CVSS v3.1: 6.5
GHSA-r6pf-3j3c-px2j: In libstagefright, there is a possible dead loop due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124783982
GHSA-3cmm-g83j-44q7: Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.
CVE-2008-4791: The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors.
CVSS v2.0: 6
CVE-2005-0770: Format string vulnerability in DataRescue Interactive Disassembler and Debugger (IDA) Pro 4.7.0.830 allows remote attackers or local users to cause a denial of service (CPU consumption or application crash) and possibly execute arbitrary code via format string specifiers in a dynamic link library (DLL) name.
CVSS v2.0: 7.5
GHSA-c4jw-7rrh-c6pc: Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands via the (1) Login parameter (aka username field) or the (2) Password parameter (aka password field).  NOTE: some of these details are obtained from third party information.
RHSA-2022:1823: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
mod_auth_openidc: open redirect in oidc_validate_redirect_url() mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption mod_auth_openidc: XSS when using OIDCPreservePost On mod_auth_openidc: open redirect due to target_link_uri parameter not validated
CVSS v3.1: 6.1
CVSS v3.0: 6.1
CVE-2024-51717: WordPress Ajax Content Filter  plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through <= 1.0.
CVSS v3.1: 7.1
CVE-2018-6917: In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided font parameters can result in an integer overflow, leading to the use of arbitrary kernel memory as glyph data. Unprivileged users may be able to access privileged kernel data.
CVSS v3.0: 7.5
CVSS v2.0: 5
RHSA-2016:0599: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update
tomcat: non-persistent DoS attack by feeding data by aborting an upload EAP: HTTPS NIO connector uses no timeout when reading SSL handshake from client
GHSA-3crx-72mc-vg28: In Modem, there is a possible out of bonds write due to a mission bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00957388; Issue ID: MSV-1872.
CVSS v3.1: 6.7
CVE-2017-6970: AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlienVault ID ENG-104863.
CVSS v3.0: 8.4
CVSS v2.0: 4.6