ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-m2m6-cff5-3w7c: RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
SummaryServer actions in `rwsdk` apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached.ImpactAn attacker who controls any origin the browser considers same-site with the deployed app can induce an authenticated victim's browser to invoke arbitrary server actions. The exposure depends on deployment shape:Apps deployed on custom domains (for example `app.example.com`) are exposed whenever the attacker controls any sibling subdomain under the same registrable domain. Plausible vectors include subdomain takeover of stale DNS records pointing at third-party services, cross-site scripting on a sibling application, or content served from a user-content subdomain.Apps deployed on platform-suffix domains on the Public Suffix List (`*.workers.dev`, `*.pages.dev`) are not exposed to the sibling-subdomain vector, because sibling subdomains under those suffixes are treated as cross-site.In local development, `localhost` on any other port is treated as same-site with the app's dev server. A separate process running on the developer's machine can invoke server actions against the dev server.The attacker cannot read action responses (`mode: "no-cors"` yields opaque responses). Impact is therefore limited to side effects of action invocation: writes, state changes, and any externally observable action the application performs in response.Cross-site requests from unrelated origins (`evil.com` targeting `app.com`) are not affected because `SameSite=Lax` session cookies are not attached by default in that scenario.Affected ConfigurationsApplications using `rwsdk` server actions (`serverAction()` or functions invoked via the RSC action protocol) in combination with cookie-based authentication. `serverQuery()` is not affected because it is designed to be idempotent and is invoked via GET.PatchThe patched release enforces an Origin/Host match for non-GET action requests. Requests whose `Origin` header does not match the request's own origin are rejected with HTTP 403 unless the origin is listed in a new `allowedOrigins` configuration option.No application code changes are required for apps that invoke server actions from their own origin. Apps that legitimately invoke server actions from another origin must add those origins to the `allowedOrigins` option on `defineApp`.CreditsReported by `@mthx`.
CVSS v3.1: 5.3
CVE-2017-10615: Junos: Potential remote code execution vulnerability in PAM
A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D50 on EX and QFX series; 14.2 from 14.2R3 prior to 14.2R7-S8, 14.2R8; No other Junos OS releases are affected by this issue. No other Juniper Networks products are affected by this issue.
CVSS v3.0: 9.8
CVE-2016-0993: Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-6xhg-q9c8-rj32: Credential leak in react-native-fast-image
This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with `source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }}` is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
CVSS v3.1: 5.3
CVE-2025-38543: drm/tegra: nvdec: Fix dma_alloc_coherent error check
In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: nvdec: Fix dma_alloc_coherent error check

Check for NULL return value with dma_alloc_coherent, in line with
Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'.
CVSS v3.1: 5.5
GHSA-h43r-9pq6-rj78: IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856.
CVSS v3.1: 3.3
GHSA-98gq-6hxg-52r6: XSS vulnerability in Jenkins notification bar
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.
CVSS v3.1: 5.4
PYSEC-2022-43069: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVSS v3.1: 8.8
RHSA-2022:7051: Red Hat Security Advisory: OpenJDK 17.0.5 Security Update for Windows Builds
OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366)
CVSS v3.1: 3.7
GHSA-f833-28c2-4pqr: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106, CVE-2020-17107, CVE-2020-17108, CVE-2020-17110.
CVSS v3.1: 7.8
GHSA-83mp-v668-7jmh: An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter.
CVSS v3.0: 4.8
GHSA-j464-8gjj-h5jc: The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
CVE-2011-0545: Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter.
CVSS v2.0: 6.8
CVE-2010-4442: Unspecified vulnerability in Oracle Solaris 10 and 11 Express allows local users to affect availability via unknown vectors related to the Kernel.
CVSS v2.0: 4.4
GHSA-jq4q-qcfh-gq3c: ParaChat Server 4.0 does not log users off if the browser's back button is used, which allows remote attackers to cause a denial of service by repeatedly logging into a chat room, hitting the back button, then logging into the same chat room as a different user, which fills the chat room with invalid users.
CVE-2019-16700: The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2017-2133: SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2016-4363: HPE Insight Control server deployment allows remote attackers to modify data via unspecified vectors.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
cisco-sa-20180117-nxos1: Cisco NX-OS System Software Unauthorized User Account Deletion Vulnerability
A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device.

The vulnerability is due to a lack of proper role-based access control (RBAC) checks for the actions that a user with the network-operator role is allowed to perform. An attacker could exploit this vulnerability by authenticating to the device with user credentials that give that user the network-operator role. Successful exploitation could allow the attacker to impact the integrity of the device by deleting configured user credentials. The attacker would need valid user credentials for the device.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos1 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos1"]
CVSS v3.0: 6.1
CVE-2024-0082: CVE
NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the application. A successful exploit of this vulnerability might lead to local escalation of privileges, information disclosure, and data tampering
CVSS v3.1: 8.2
GHSA-w65r-3xh2-3pj4: This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVSS v3.1: 4
GHSA-jp3f-6v6c-9w56: Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service (crash) or "compromise the server" via encoded format string specifiers in the query string.
CVE-2020-3988: VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.
CVSS v3.1: 6.1
CVSS v2.0: 3.6
CVE-2011-2811: WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
CVSS v2.0: 7.6
GHSA-26x8-wc99-6x99: read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
CVSS v3.1: 6.5
CVE-2021-32733: XSS in Nextcloud Text application
Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.
CVSS v3.1: 4.8
CVE-2018-7792: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-6247: scratchblocks for WP <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2006-0082: Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.
CVSS v2.0: 5.1
CVE-2025-49181: Configurations endpoint does not require authorization
Due to missing authorization of an API endpoint, unauthorized users can send HTTP GET
requests to gather sensitive information. An attacker could also send HTTP POST requests to modify
the log files’ root path as well as the TCP ports the service is running on, leading to a Denial of Service
attack.
CVSS v3.1: 8.6
CVE-2012-0355: Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(2.11) and 8.5 before 8.5(1.4) allow remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger syslog message 305006, aka Bug ID CSCts39634.
CVSS v2.0: 7.8
GHSA-fw7q-prfm-977f: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CVSS v3.1: 5.5
GHSA-chf8-4hv6-8pg6: Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
SummaryThe Fission `storagesvc` component registers archive CRUD handlers (`/v1/archive` GET / POST / DELETE and `/v1/archives` list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the `storagesvc` ClusterIP — including  any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives.Affected component`pkg/storagesvc/storagesvc.go` — handler registration and per-route handler logic at lines   72-95 (list), 167-199 (download/delete), and 263-270 (route wiring).ImpactA workload elsewhere in the cluster (e.g. a compromised function pod, a noisy-neighbour tenant in a multi-tenant deployment, or any pod whose egress is not constrained by NetworkPolicy) could:Enumerate every function deployment archive in the cluster.Download the deployment archive of any function in any namespace, exposing the function's source code and any embedded secrets.Delete archives, causing the next function specialization or rebuild to fail.Upload arbitrary archives that subsequent function specializations would fetch and execute.In multi-tenant Fission deployments this completely breaks the tenant boundary for function code.Root cause`pkg/storagesvc/storagesvc.go` mounts the handlers without an authentication middleware. Network-layer controls (`NetworkPolicy`) were the only line of defence before this fix, and the chart shipped no `NetworkPolicy` for `storagesvc` by default, so reachability was open.FixReleased in [v1.23.0](https://github.com/fission/fission/releases/tag/v1.23.0):**PR #3368** (commit `2455fc0c`) wraps the `storagesvc` archive routes with the application-layer HMAC verifier from `pkg/auth/hmac` using the `ServiceStoragesvc` derived key. Callers (executor, fetcher, builder, CLI) sign their requests using a shared cluster master secret derived per-service via HKDF. Mismatched signatures are rejected with `401`.Defence in depth: **PR #3365** added a `NetworkPolicy` for `storagesvc` so only the executor/fetcher/builder pods can reach it network-layer (independent of authentication).Mitigation (until upgrade)Enable the Helm chart's per-service NetworkPolicy (set `networkPolicy.enabled=true`).Restrict `storagesvc` egress/ingress to the executor, builder, and fetcher pods only.Avoid running untrusted workloads in the cluster that hosts Fission.
CVSS v3.1: 8.8
GHSA-2cp6-34r9-54xx: Maker.js has Unsafe Property Copying in makerjs.extendObject
SummaryThe `makerjs.extendObject` function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks `hasOwnProperty()` checks and does not filter dangerous keys, allowing inherited properties and potentially malicious properties to be copied to target objects.DetailsThe `extendObject` function iterates over source object properties using a `for...in` loop without:Checking `hasOwnProperty()` to exclude inherited propertiesFiltering dangerous keys (`__proto__`, `constructor`, `prototype`)Validating property sourcesAffected Code**File**: https://github.com/microsoft/maker.js/blob/98cffa82a372ff942194c925a12a311253587167/packages/maker.js/src/core/maker.ts#L232-L241PoCImpactSecurity Implications**Unexpected Behavior**: Properties may appear on target objects but not be own properties, breaking `hasOwnProperty()` assumptions in security-sensitive code.**Security Bypass Risk**: Code relying on `hasOwnProperty()` for validation could be bypassed.**Future Risk**: Lack of dangerous key filtering (`__proto__`, `constructor`, `prototype`) exposes potential attack vectors.Affected Use CasesExtending objects from user input or external APIsMerging options from untrusted sources
CVSS v3.1: 6.5
GHSA-xpp7-3x3w-4w29: An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames.
CVSS v3.1: 6.2
RHSA-2024:0561: Red Hat Security Advisory: linux-firmware security update
amd: Return Address Predictor vulnerability leading to information disclosure hw: amd: Cross-Process Information Leak
CVSS v3.1: 6.5
GHSA-grjv-gjgr-66g2: SpiceDB exclusions can result in no permission returned when permission expected
BackgroundUse of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.For example, given this schema:If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returnedImpactPermission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API.WorkaroundsNone
CVSS v4.0: 6.3
CVSS v3.1: 3.7
GHSA-f6xq-mw44-h29j: Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password.
CVSS v3.0: 8.8
GHSA-r87r-982q-2c3q: Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
ImpactUnauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.PatchesUpdate to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patchWorkaroundsApply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.Referenceshttps://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
CVSS v3.0: 7.6
GHSA-6682-gq2x-qwh3: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
CVE-2026-10287: SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function get_headers of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
RHSA-2007:0022: Red Hat Security Advisory: squirrelmail security update
Three XSS issues in SquirrelMail
GHSA-mcp2-9qpg-mmvj: The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 7.1
CVE-2024-23441: Vba32 Antivirus v3.36.0 - Denial of Service (DoS)
Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.
CVSS v3.1: 5.5
GHSA-f5x9-mwv6-rmv7: An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.
CVSS v3.0: 5.5
CVE-2015-0662: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
CVSS v2.0: 7.2
GHSA-g22c-7jx3-r485: A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.
CVSS v3.0: 7.8
ICSA-14-030-01: 3S CoDeSys Runtime Toolkit NULL Pointer Dereference
Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
GHSA-4qv6-g5fw-f876: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
CVE-2025-22329: WordPress Free Google Maps plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Free Google Maps wp-map allows Stored XSS.This issue affects Free Google Maps: from n/a through <= 1.0.1.
CVSS v3.1: 6.5
GHSA-xrj4-4g3m-87pf: In the Linux kernel, the following vulnerability has been resolved:net: rose: convert 'use' field to refcount_tThe 'use' field in struct rose_neigh is used as a reference counter but
lacks atomicity. This can lead to race conditions where a rose_neigh
structure is freed while still being referenced by other code paths.For example, when rose_neigh->use becomes zero during an ioctl operation
via rose_rt_ioctl(), the structure may be removed while its timer is
still active, potentially causing use-after-free issues.This patch changes the type of 'use' from unsigned short to refcount_t and
updates all code paths to use rose_neigh_hold() and rose_neigh_put() which
operate reference counts atomically.
CVSS v3.1: 7
GHSA-qw95-4jrg-j479: In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length.
CVSS v3.0: 7.5
CVE-1999-1023: useradd in Solaris 7.0 does not properly interpret certain date formats as specified in the "-e" (expiration date) argument, which could allow users to login after their accounts have expired.
CVSS v2.0: 4.6