ansulev/circl-vulnerability-scores huggingface dataset:
ICSA-26-092-03: Hitachi Energy Ellipse
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Ellipse product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
CVSS v3.1: 9.8
GHSA-rphv-339g-76cw: The WordPress eCommerce Plugin  WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 7.1
GHSA-64wx-c7jg-27vx: The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 6.1
GHSA-2wp7-73q4-52p8: IBM QRadar 7.3, 7.4, and 7.5 could allow a malicious actor to impersonate an actor due to key exchange without entity authentication. IBM X-Force ID: 208756.
CVSS v3.1: 7.5
CVE-2026-24899: Fleet Windows MDM Azure AD JWT Authentication Bypass
Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet's MDM endpoints. If Windows MDM is enabled, an attacker with access to any Azure AD tenant can obtain a valid Microsoft-signed token and use it to enroll unauthorized devices and interact with Fleet's MDM management APIs. During device management, Fleet may expose sensitive enrollment secrets embedded in MDM command payloads, enabling further unauthorized access. Version 4.82.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
CVSS v4.0: 8.2
CVE-2023-52801: iommufd: Fix missing update of domains_itree after splitting iopt_area
In the Linux kernel, the following vulnerability has been resolved:

iommufd: Fix missing update of domains_itree after splitting iopt_area

In iopt_area_split(), if the original iopt_area has filled a domain and is
linked to domains_itree, pages_nodes have to be properly
reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.
CVSS v3.1: 9.1
GHSA-xv22-g7rf-h2p4: Use-after-free vulnerability in the color-chooser dialog in Google Chrome before 30.0.1599.66 on Windows allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to color_chooser_dialog.cc and color_chooser_win.cc in browser/ui/views/.
CVE-2021-2126: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N).
CVSS v3.1: 6
CVE-2008-1212: Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 4.3
GHSA-2844-p28c-wcj6: External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message.
Refer to the '
Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.
CVSS v4.0: 8.5
GHSA-5w6q-xrqg-g6cg: The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
CVE-2012-3750: The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.
CVSS v2.0: 3.6
RHSA-2025:16046: Red Hat Security Advisory: mysql:8.4 security update
mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Options unspecified vulnerability (CPU Apr 2025) mysql: DML unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: DDL unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: DML unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: mariadb: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: UDF unspecified vulnerability (CPU Apr 2025) mysql: mariadb: mysqldump unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DML unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) mysql: mysqldump unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Components Services unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Encryption unspecified vulnerability (CPU Jul 2025) mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025)
CVSS v3.1: 2.7
CVE-2019-5503: OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-r53h-jp5f-7qxm: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.
CVSS v3.1: 8.8
GHSA-fhrm-2hv9-qhh7: Format string vulnerability in the SSL_set_verify function in telnetd.c for SSLtelnet daemon (SSLtelnetd) 0.13 allows remote attackers to execute arbitrary code.
GHSA-p7q9-c7hh-v46v: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
CVSS v3.0: 3.1
CVE-2002-1637: Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.
CVSS v2.0: 4.6
GHSA-rx6c-f53h-64vg: Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS v3.1: 7.8
CVE-2020-24085: A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-5xx2-qfp4-g6pq: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave.
CVSS v3.1: 7.5
CVE-2015-7336: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2018-3758: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
CVSS v3.1: 8.8
CVSS v2.0: 9
GHSA-j95f-5r5g-7mrr: A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the Secure Sockets Layer (SSL) inspection policy is enabled. An attacker could exploit this vulnerability by sending malicious traffic through an affected device. An exploit could allow the attacker to increase the resource consumption of a single instance of the Snort detection engine on an affected device. This will lead to performance degradation and eventually the restart of the affected Snort process. Cisco Bug IDs: CSCvi09219, CSCvi29845.
CVSS v3.0: 7.5
CVE-2018-5794: An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is No Authentication for the AeroScout Service via a crafted UDP packet.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-47vm-xhwp-2v86: OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.  NOTE: this vulnerability exists because of a CVE-2015-3280 regression.
CVSS v3.0: 6.5
GHSA-jjqv-555m-3f57: The IPv6 implementation on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) exposes IP services on the "far side of the box," which might allow remote attackers to bypass intended access restrictions via IPv6 packets, aka Bug ID CSCso58622.
CVE-2018-0244: A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block (SMB) protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handles a case in which a large file transfer fails. This case occurs when some pieces of the file are successfully transferred to the remote endpoint, but ultimately the file transfer fails and is reset. An attacker could exploit this vulnerability by sending a crafted SMB file transfer request through the targeted device. An exploit could allow the attacker to pass an SMB file that contains malware, which the device is configured to block. This vulnerability affects Cisco Firepower System Software when one or more file action policies are configured, on software releases prior to 6.2.3. Cisco Bug IDs: CSCvc20141.
CVSS v3.0: 5.8
CVSS v2.0: 5
GHSA-vxfq-2mx9-7884: Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVSS v3.1: 8.8
GHSA-fpw4-7h2w-2x94: Transient DOS in WLAN Firmware while processing a FTMR frame.
CVSS v3.1: 7.5
GHSA-mw3w-f2gc-g47m: vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVSS v3.1: 9.8
GHSA-h2rc-3ppq-6pjg: The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
CVE-2025-31089: WordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fahad Mahmood Order Splitter for WooCommerce woo-order-splitter allows SQL Injection.This issue affects Order Splitter for WooCommerce: from n/a through <= 5.3.0.
CVSS v3.1: 8.5
CVE-2026-35398: WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage']
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
CVSS v4.0: 5.1
CVE-2020-8990: Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2007-3881: SQL injection vulnerability in index.php in Pictures Rating (Picture Rating) allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
CVSS v2.0: 7.5
GHSA-wwgp-82c5-fmmh: The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23_gloria_settings_page function. This makes it possible for unauthenticated attackers to reset the tenant ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-m9f2-m8h2-3c6r: Unspecified vulnerability in Oracle SysFW 8.1.0.a in various Oracle SPARC T3, Netra SPARC T3, Sun Fire, and Sun Blade servers allows remote attackers to affect confidentiality, integrity, and availability, related to Sun Integrated Lights Out Manager (ILOM).
GHSA-979w-pv5p-v945: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.
CVSS v3.1: 7.1
GHSA-356v-2cpg-fj3v: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33899363. References: N-CVE-2017-0333.
CVSS v3.0: 7.8
GHSA-8h6w-5gpw-7wpv: SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands.
CVE-2004-1468: The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.
CVSS v2.0: 7.5
GHSA-66pp-5p9w-q87j: Shescape has potential environment variable exposure on Windows with CMD
ImpactThis impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`.An attacker may be able to get read-only access to environment variables. Example:For Shescape prior to v2.0.0, the `options` object must have `shell: 'cmd.exe'` or `shell: undefined` and `interpolation: true`.PatchesThis bug has been patched in [v2.1.2](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2) which you can upgrade to now.If you are already using v2 of Shescape, no further changes are required. If you are using v1 of Shescape, follow the [migration guide](https://github.com/ericcornelissen/shescape/blob/155b13b4141750203ce71249f1b0fdc638c7a0d0/docs/migration.md) to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape.WorkaroundsAlternatively, users can remove all instances of % from user input before using Shescape.ReferencesShescape Pull Request [#1916](https://github.com/ericcornelissen/shescape/pull/1916)Shescape commit [0a81f1e](https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6)Shescape release [v2.1.2](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2)For more informationComment on Pull Request [#1916](https://github.com/ericcornelissen/shescape/pull/1916)Comment on commit [0a81f1e](https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6)Open an issue at [https://github.com/ericcornelissen/shescape/issues](https://github.com/ericcornelissen/shescape/issues) (New issue > Question)
CVSS v4.0: 2.1
CVE-2016-1248: vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-98qr-8739-wxqq: The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.
CVSS v3.1: 8.8
CVE-2023-38181: Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
CVSS v3.1: 8.8
GHSA-83r7-xqx3-27xr: Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST request with an empty HTTP body is sent to the SBI of either AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR, resulting in a denial of service. This occurs in the parse_multipart function in lib/sbi/message.c.
CVSS v3.1: 4
CVE-2016-4790: Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 5.5
CVSS v2.0: 3.5
GHSA-hpc8-7wpm-889w: Dragonfly2 has hard coded cyptographic key
SummaryHello dragonfly maintainer team, I would like to report a security issue concerning your JWT feature.DetailsDragonfly uses  [JWT](https://github.com/dragonflyoss/Dragonfly2/blob/cddcac7e3bdb010811e2b62b3c71d9d5c6749011/manager/middlewares/jwt.go) to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypassPoCUse code below to generate a jwt tokenAnd send request with JWT above , you can still get data without restriction.
<img width="1241" alt="image" src="https://user-images.githubusercontent.com/70683161/224255896-8604fa70-5846-4fa0-b1f9-db264c5865fe.png">ImpactAn attacker can perform any action as a user with admin privileges.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-2rq4-xq7w-xw4p: Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382.
CVSS v3.0: 8.8
CVE-2025-52549: Predictable root linux password generation
E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
CVSS v4.0: 9.2
GHSA-2mv9-fr3x-rh65: Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
GHSA-663r-jp8j-qr4q: Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-5cqv-66q8-6qv3: The driver of honor 5C,honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356, versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart phone, causing a system reboot or arbitrary code execution.
CVSS v3.0: 7.8