ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6jjp-3pp9-h253: Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.
CVSS v3.1: 6.5
CVE-2016-7564: Heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS allows attackers to cause a denial of service (crash) via crafted input.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-m5v2-jw65-jh59: Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
GHSA-cwpg-qgc6-jxvq: Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
CVSS v3.1: 9.8
GHSA-fmrf-gvjp-5j5g: Improper Privilege Management in Cilium
ImpactIf an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can leverage Cilium's Kubernetes service account to gain access to cluster privileges that are more permissive than what is minimally required to operate Cilium. In affected releases, this service account had access to modify and delete `Pod` and `Node` resources.PatchesThe problem has been fixed and is available on versions >=1.9.16, >=1.10.11, >=1.11.5WorkaroundsThere are no workarounds available.AcknowledgementsThe Cilium community has worked together with members of Isovalent, Amazon and Palo Alto Networks to prepare these mitigations.  Special thanks to Micah Hausler (AWS), Robert Clark (AWS), Yuval Avrahami (Palo Alto Networks), and Shaul Ben Hai (Palo Alto Networks) for their cooperation.For more informationIf you have any questions or comments about this advisory:Email us at [security@cilium.io](mailto:security@cilium.io)
CVSS v3.1: 7.5
GHSA-p6qm-gff4-54rj: OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4532.
CVSS v3.0: 8.8
CVE-2024-51714: WordPress User Password Reset plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techdabang User Password Reset user-password-reset allows Reflected XSS.This issue affects User Password Reset: from n/a through <= 1.0.
CVSS v3.1: 7.1
CVE-2002-0122: Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters.
CVSS v2.0: 5
GHSA-62hx-72qc-gr7j: An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue.
CVSS v3.0: 7.8
CVE-2009-2846: The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
CVSS v2.0: 7.8
GHSA-9xwx-qrg8-w6m2: Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2005-1162: Multiple cross-site scripting (XSS) vulnerabilities in OneWorldStore allow remote attackers to inject arbitrary web script or HTML via the (1) sEmail parameter to owContactUs.asp, (2) bSub parameter to owListProduct.asp, or the (3) Name, (4) Email, or (5) Comment fields in owProductDetail.asp.
CVSS v2.0: 5.8
GHSA-7q44-gfvq-6g93: SQL Injection in Subrion CMS
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
CVSS v3.1: 9.8
GHSA-28xr-rgjv-2mgp: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-f6r5-69p8-66w6: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to arbitrary physical system memory, which may lead to an escalation of privileges.
CVSS v3.0: 7.8
CVE-2022-35465: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0414.
CVSS v3.1: 6.5
CVE-2020-26035: An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-4x79-6w4j-gwx6: The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.
CVE-2025-21036: Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is required for triggering this vulnerability.
CVSS v3.1: 5
GHSA-rcrh-rjwq-6v33: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modules) allows HTTP Request Smuggling via the Content-Length-Transfer-Encoding (CL.TE) attack vector. This could allow an attacker to bypass access controls, poison web caches, hijack sessions, or trigger unintended internal requests. This issue affects Coexistence Manager for Notes 3.8.2045. Other versions may also be affected.
CVSS v4.0: 6.3
GHSA-jwp6-cvj8-fw65: Apache Spark: Spark History Server Code Execution Vulnerability
This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue.SummaryApache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server.DetailsThe vulnerability arises because the Spark History Server uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating unintended classes, such as org.apache.hive.jdbc.HiveConnection, which can perform network calls or other malicious actions during deserialization.The attacker can exploit this by injecting crafted JSON content into the Spark event log files, which the History Server then deserializes on startup or when loading event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote attacker-controlled server, demonstrating remote command injection capability.Proof of Concept:Run Spark with event logging enabled, writing to a writable directory (spark-logs).Inject the following JSON at the beginning of an event log file:Start the Spark History Server with logs pointing to the modified directory.The Spark History Server initiates a JDBC connection to the attacker’s server, confirming the injection.ImpactAn attacker with write access to Spark event logs can execute arbitrary code on the server running the History Server, potentially compromising the entire system.
CVSS v3.1: 8.8
CVE-2013-7175: Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) Title, (2) File name, or (3) Candidate Name field.
CVSS v2.0: 6.5
CVE-2026-44865: Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS v3.1: 7.2
GHSA-ph8m-x93x-px88: An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application.
CVSS v3.1: 8.8
GHSA-4j38-964f-658r: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVSS v3.1: 9.8
CVE-2025-25372: NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.
CVSS v3.1: 7.5
CVE-2010-1909: Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.6
GHSA-wv9w-wxcx-6r72: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22138.
CVSS v3.0: 7.8
CVE-2008-4661: Cross-site scripting (XSS) vulnerability in the Page Improvements (sm_pageimprovements) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
CVE-2003-0332: The ISAPI extension in BadBlue 1.7 through 2.2, and possibly earlier versions, modifies the first two letters of a filename extension after performing a security check, which allows remote attackers to bypass authentication via a filename with a .ats extension instead of a .hts extension.
CVSS v2.0: 7.6
CVE-2012-4090: The management interface in Cisco NX-OS on Nexus 7000 devices allows remote authenticated users to obtain sensitive configuration-file information by leveraging the network-operator role, aka Bug ID CSCti09089.
CVSS v2.0: 4
CVE-2023-49836: WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brontobytes Cookie Bar allows Stored XSS.This issue affects Cookie Bar: from n/a through 2.0.
CVSS v3.1: 5.9
CVE-2018-17631: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the removeInstance event. The issue results from the lack of validation of the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6500.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-vxh3-mvv7-265j: Cross-site scripting invenio-records
Cross-Site Scripting (XSS) vulnerability in administration interfaceImpactA Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.PatchesAll supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2For more informationIf you have any questions or comments about this advisory:Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
CVSS v4.0: 5.1
CVSS v3.0: 5.4
CVE-2026-29124: Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege Escalation
Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/monitor/IDE-DPack/terminal-dpack, and /home/monitor/IDE-DPack/terminal-dpack2 in International Data Casting (IDC) SFX2100 Satellite Receiver, which may lead to local privlidge escalation from the `monitor` user to root
CVSS v4.0: 8.6
CVE-2002-0444: Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g. with a maximum number of licenses, which can allow remote authenticated users to bypass group policies.
CVSS v2.0: 7.5
CVE-2021-32029: A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2021-27731: Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-7c9c-qrrc-jc5x: libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.
CVSS v3.1: 8.8
CVE-2006-1739: The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow.
CVSS v2.0: 9.3
CVE-2024-37104: WordPress Chic Lite theme <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Chic Lite chic-lite allows Cross Site Request Forgery.This issue affects Chic Lite: from n/a through <= 1.1.3.
CVSS v3.1: 4.3
CVE-2022-37880: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS v3.1: 7.2
GHSA-r9wj-gm7p-2529: A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28) in place of the expected SSH protocol delimiter.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-xv35-w389-wr74: HCL SX v21 is affected by usage of a weak cryptographic algorithm.  An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
CVSS v3.1: 6.5
CVE-2017-7870: LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-r2rg-683g-ff96: Malicious Package in axios-http
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.RecommendationRemove the package from your environment. There are no indications of further compromise.
CVSS v3.1: 9.8
CVE-2019-4674: IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 171510.
CVSS v3.0: 6.8
CVE-2022-44037: An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple attacks, such as attacking wireless network in the product's range.
CVSS v3.1: 8.8
GHSA-g5g7-5r9g-2xpx: An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer, a different vulnerability than CVE-2019-16357.
CVE-2023-7297: TwitterPosts  <= 1.0.2 - Settings Update via CSRF
The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS v3.1: 3.5
CVE-2025-30000: A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-47x2-3wfg-624p: The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.
CVSS v3.1: 4.3
CVE-2023-45085: When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"
An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process.  In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads that may be deployed during this time window.

This issue impacts HyperCloud versions from 2.0.0 to before 2.0.3.


CVSS v3.1: 3.2
CVE-2024-48510: Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1: 9.1
GHSA-84gc-54qf-v3jp: Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.
CVSS v4.0: 8.5
GHSA-3jmw-c69h-426c: Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
ImpactA user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.PatchesAvailable in Rundeck 3.4.3 and 3.3.14WorkaroundsPlease visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.For more informationIf you have any questions or comments about this advisory:Email us at [security@rundeck.com](mailto:security@rundeck.com)To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
CVSS v3.1: 7.2
RHSA-2017:2424: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: reading of unprocessed image data in JPEGImageReader (2D, 8169209) OpenJDK: JAR verifier incorrect handling of missing digest (Security, 8169392) OpenJDK: integer overflows in range check loop predicates (Hotspot, 8173770) OpenJDK: incorrect bracket processing in function signature handling (Hotspot, 8170966) OpenJDK: insufficient access control checks in ThreadPoolExecutor (Libraries, 8172204) OpenJDK: insufficient access control checks in ServiceRegistry (ImageIO, 8172461) OpenJDK: insufficient access control checks in AsynchronousChannelGroupImpl (8172465, Libraries) OpenJDK: insufficient access control checks in XML transformations (JAXP, 8172469) OpenJDK: unrestricted access to com.sun.org.apache.xml.internal.resolver (JAXP, 8173286) OpenJDK: incorrect handling of references in DGC (RMI, 8163958) OpenJDK: insufficient access control checks in ActivationID (RMI, 8173697) OpenJDK: unbounded memory allocation in BasicAttribute deserialization (Serialization, 8174105) OpenJDK: unbounded memory allocation in CodeSource deserialization (Serialization, 8174113) OpenJDK: insufficient access control checks in ImageWatched (AWT, 8174098) OpenJDK: DSA implementation timing attack (JCE, 8175106) OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067) OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760) OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)
CVSS v3.0: 6.5
CVE-2013-0934: EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and modify global reports via unspecified vectors.
CVSS v2.0: 4