ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v49x-8hvm-q347: Exposure of Sensitive Information in Apache Pluto
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
CVSS v3.0: 7.5
GHSA-vwh5-q72r-gr35: A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0), SCALANCE S612 (All versions >= V3.0), SCALANCE S623 (All versions >= V3.0), SCALANCE S627-2M (All versions >= V3.0). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. A cold reboot is required to restore the functionality of the device.
CVE-2021-35991: Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Bridge version 11.0.2 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information  in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 3.3
GHSA-296g-m5cw-f8p9: A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted packet to an affected device. A successful exploit could allow the attacker to cause the Cisco AMP for Endpoints service to crash and restart.
GHSA-v5hv-5v7h-rxpc: Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
CVSS v3.1: 8.8
GHSA-h887-7vmx-g264: The issue was addressed with improvements to the file handling protocol. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to break out of its sandbox.
CVSS v3.1: 8.6
GHSA-f2j5-6ccc-fcjg: Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable a denial of service via local access.
GHSA-h3xg-wv58-5p43: Ray OS Command Injection vulnerability
A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.
CVSS v3.1: 9.8
CVE-2023-33795: A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS v3.1: 5.4
GHSA-mgwf-4gww-g338: IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847.
GHSA-fv44-8gjm-pj66: Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.
CVSS v4.0: 5.1
CVSS v3.1: 4.4
CVE-2022-3071: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
CVSS v3.1: 8.8
GHSA-5cgj-3m9p-9jvq: Directory traversal vulnerability in includes/operator_chattranscript.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to read arbitrary files via a .. (dot dot) in the chatid parameter.
GHSA-pc86-jmjr-hvxg: GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter.
CVE-2020-25461: Invalid Memory Access in the fxProxyGetter function in moddable/xs/sources/xsProxy.c in Moddable SDK before OS200908 causes a denial of service (SEGV).
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-f8m7-hvrf-gm4v: A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 8.9
CVSS v3.1: 9.8
GHSA-225x-576g-4f7p: Buffer overflow in Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (system crash) via a crafted app.
CVSS v3.0: 5.5
GHSA-9r2w-pc52-9fv2: SQL injection vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prod parameter in a products.details action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2023-52176: WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.
CVSS v3.1: 5.3
CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
CVE-2025-9977: Improper neutralization of input in Times Software E-PAYROLL
Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms.
Additionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. 
Patching status is unknown because the vendor has not replied to messages sent by the CNA.
CVSS v4.0: 5.3
CVE-2008-5588: SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter.
CVSS v2.0: 7.5
CVE-2025-71187: dmaengine: sh: rz-dmac: fix device leak on probe failure
In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sh: rz-dmac: fix device leak on probe failure

Make sure to drop the reference taken when looking up the ICU device
during probe also on probe failures (e.g. probe deferral).
CVSS v3.1: 5.5
GHSA-xw8r-2c2x-7j88: By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization.
CVSS v3.0: 9.1
GHSA-rp38-pj7h-r8q2: python-a2a has a path traversal in the create_workflow function
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.1
CVSS v3.1: 5.5
RHSA-2014:0310: Red Hat Security Advisory: firefox security update
Mozilla: Miscellaneous memory safety hazards (rv:24.4) (MFSA 2014-15) Mozilla: Out of bounds read during WAV file decoding (MFSA 2014-17) Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28) Mozilla: Information disclosure through polygon rendering in MathML (MFSA 2014-26) Mozilla: Memory corruption in Cairo during PDF font rendering (MFSA 2014-27) Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29) Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29) Mozilla: Use-after-free in TypeObject (MFSA 2014-30) Mozilla: Out-of-bounds read/write through neutering ArrayBuffer objects (MFSA 2014-31) Mozilla: Out-of-bounds write through TypedArrayObject after neutering (MFSA 2014-32)
GHSA-59f3-q6cq-qcpj: Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file.
GHSA-9v2j-c293-g6cj: An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily disable the SMB service on a victim's Qstar instance by executing a specific command in a link.
CVSS v3.1: 6.5
RHSA-2026:3638: Red Hat Security Advisory: nginx:1.24 security update
nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
CVSS v3.1: 5.9
GHSA-87v3-xghc-4m97: A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component DEBUG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-3g48-cr7g-6ph4: A flaw was found in Infinispan version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.
CVE-2006-0483: Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.
CVSS v2.0: 7.8
CVE-2023-6505: Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.
CVSS v3.1: 7.5
CVE-2024-23610: Out of Bounds Write Due to Missing Bounds Check in LabVIEW
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.



CVSS v3.1: 7.8
CVE-2025-43586: Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.
CVSS v3.1: 8.1
GHSA-hrwc-pg2q-pgc2: In the Linux kernel, the following vulnerability has been resolved:scsi: pm8001: Fix use-after-free for aborted TMF sas_taskCurrently a use-after-free may occur if a TMF sas_task is aborted before we
handle the IO completion in mpi_ssp_completion(). The abort occurs due to
timeout.When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the
sas_task is freed in pm8001_exec_internal_tmf_task().However, if the I/O completion occurs later, the I/O completion still
thinks that the sas_task is available. Fix this by clearing the ccb->task
if the TMF times out - the I/O completion handler does nothing if this
pointer is cleared.
CVSS v3.1: 7.8
GHSA-jxc4-54g3-j7vp: Indico Affected by Cross-Site-Scripting via material uploads
ImpactThere is a Cross-Site-Scripting vulnerability when uploading certain file types as materials.PatchesYou should to update to [Indico 3.3.10](https://github.com/indico/indico/releases/tag/v3.3.10) as soon as possible.
See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.Please be aware that to apply the fix itself updating is sufficient, but to benefit from the strict Content-Security-Policy we now apply by default for file downloads, you need to update your webserver config in case you use nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect` and add the following line to the `.xsf/indico/` location block (you can consult the Indico setup documentation for the full configuration snippet):WorkaroundsUse your webserver config to apply a strict CSP for material download endpoints.Only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico.For more informationIf you have any questions or comments about this advisory:Open a thread in [our forum](https://talk.getindico.io/)Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
CVSS v3.1: 5.4
GHSA-295r-226x-w9x2: In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204083967
CVSS v3.1: 7.8
CVE-2020-23973: KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2011-1748: The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
CVSS v2.0: 4.9
CVE-2025-1853: Tenda AC8 Parameter SetIpMacBind sub_49E098 stack-based overflow
A vulnerability was found in Tenda AC8 16.03.34.06 and classified as critical. This issue affects the function sub_49E098 of the file /goform/SetIpMacBind of the component Parameter Handler. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-jqgf-593x-g5mw: In SWFTools, a memcpy buffer overflow was found in swfc.
CVSS v3.0: 5.5
GHSA-7gj2-q7q5-28j5: Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.
GHSA-xxxj-w44j-q5cf: A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.We have already fixed the vulnerability in the following version:
QuMagie 2.9.0 and later
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-3qc6-x7mq-579v: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Roberto Alicata ra_qrcode allows Stored XSS.This issue affects ra_qrcode: from n/a through 2.1.0.
CVSS v3.1: 6.5
CVE-2020-25583: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a DNSSL option, rtsold(8) decodes domain name labels per an encoding specified in RFC 1035 in which the first octet of each label contains the label's length. rtsold(8) did not validate label lengths correctly and could overflow the destination buffer.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-v3vj-5868-2ch2: Rancher CLI SAML authentication is vulnerable to phishing attacks
ImpactA vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI  tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens.Rancher Manager deployments without SAML authentication enabled are not affected by this vulnerability.An attacker can generate a phishing SAML login URL which contains a `publicKey` and `requestId` controlled by the attacker. The attacker can then give the link to another user (eg: admin) and if the victim goes to the link unsuspectingly, they might not notice the bad parameters in the URL. The user will be prompted to login and might believe that its session has ended so they need to re-login. By clicking on the link, they will be logged in and an encrypted token will be created with the attacker's public key. The attacker can then decrypt the victim’s Rancher token, enabling the attackPlease consult the associated [MITRE ATTACK Techniques - Privilege Escalation](https://attack.mitre.org/tactics/TA0004/) for further information about this category of attack.PatchesThis vulnerability is addressed by changes in both Rancher Manager and the CLI. The fixed versions:The Rancher CLI now reports the `requestId` that is relevant to the authentication session in process as a separate message to the terminal, making it easier for the user to identify and compare.The Rancher login page for SAML authentication will display a suitable warning to ensure that the user seeing the login page is aware of the login process with the related `requestId`, enabling users to verify whether the request was intended or not.Patched versions of Rancher include releases v2.12.2, v2.11.6, v2.10.10, and v2.9.12.WorkaroundsIf you cannot update to one of the fixed versions, make sure to check the URL printed by the Rancher CLI when performing a SAML authentication flow, especially the `requestId` parameter. The URL and the `requestId` printed by the CLI must be the same URL that you access and see when finalizing the SAML authentication flow in your browser for the Rancher UI. The URL has the format:`<rancher_ui_address>/dashboard/auth/login?requestId=<requestid>&publicKey=<pubkey>&responseType=<responsetype>`If the URL presented in the browser is different from the one logged by the CLI, the user must not proceed with the login, as they might be under a phishing attack.ReferencesIf you have any questions or comments about this advisory:Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
CVSS v3.1: 8
CVE-2008-5104: Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
CVSS v2.0: 7.2
GHSA-q497-743q-gcfq: Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php.
CVE-2025-13469: Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting
A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument manualInstructions leads to cross site scripting. The attack can be initiated remotely. You should upgrade the affected component.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2022-28764: Local information exposure in Zoom Clients
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting that database results in a local malicious user being able to obtain meeting information such as in-meeting chat for the previous meeting attended from that local user account.
CVSS v3.1: 3.3
CVE-2008-2630: SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter in a category action to index.php.
CVSS v2.0: 7.5
CVE-2025-30827: WordPress WP2LEADS plugin <= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.5.
CVSS v3.1: 7.1
RHSA-2022:5116: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (puppet-firewall) security update
puppetlabs-firewall: unmanaged rules could leave system in an unsafe state via duplicate comment
CVSS v3.1: 9.8
CVE-2020-27406: Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-pv6v-q9mw-36pw: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
PYSEC-2023-205: LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
GHSA-f3f9-p99p-62gj: Memory corruption when keymaster operation imports a shared key.
CVSS v3.1: 7.8
GHSA-w5vx-mwg8-r6pf: piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
CVSS v3.1: 8.8
CVE-2025-3918: Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function
The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $_POST['user_role'] and passes it directly to wp_insert_user() without restricting to a safe set of roles.  This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
CVSS v3.1: 9.8
GHSA-483w-q33g-j5qq: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2019-10120: On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to use a session ID after a logout, aka HMCCU-154.
CVSS v3.0: 8.8
CVSS v2.0: 6.5