ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2021:4251: Red Hat Security Advisory: openjpeg2 security update
openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c openjpeg: division-by-zero in functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c openjpeg: integer overflow in function opj_get_encoding_parameters in openjp2/pi.c openjpeg: denial of service in function opj_t1_encode_cblks in openjp2/t1.c openjpeg: use-after-free and double-free via a mix of valid and invalid files in a directory operated on by the decompressor openjpeg: heap-buffer-overflow in lib/openjp2/mqc.c could result in DoS openjpeg: heap-buffer-overflow write in opj_tcd_dc_level_shift_encode() openjpeg: global-buffer-overflow read in opj_dwt_calc_explicit_stepsizes() openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c openjpeg: heap-buffer-overflow in color.c may lead to DoS or arbitrary code execution openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c
CVSS v3.1: 6.2
CVSS v3.0: 3.3
CVE-2024-41812: txtdot SSRF vulnerability in /get
txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery (SSRF) vulnerability in the `/get` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.7.0 prevents displaying the response of forged requests, but the requests can still be sent. For complete mitigation, a firewall between txtdot and other internal network resources should be set.
CVSS v3.1: 7.5
CVE-2011-1730: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_SCRIPT message.
CVSS v2.0: 10
GHSA-2q6p-h6rg-vx7w: Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
CVSS v3.1: 8.8
CVE-2021-27146: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-vvg2-hg3c-mqj3: Client secret transmitted in plain text by Azure AD Plugin
Azure AD Plugin stores a client secret in its global configuration.While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.
CVSS v3.1: 3.1
GHSA-35p5-4434-v68p: A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
GHSA-92fh-pv8f-mv7c: E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload '=''or' to bypass authentication and gain unauthorized access to the system.
CVSS v4.0: 8.8
CVSS v3.1: 6.5
GHSA-mpwr-mcf8-j693: goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
CVSS v3.0: 9.8
GHSA-h79h-p55m-548h: Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059.
CVSS v3.0: 4.3
GHSA-pw2v-g469-9h4v: Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 7.2
GHSA-hxj7-c89m-gvm5: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS v3.1: 6.5
GHSA-ffc8-g73r-3xvj: Multi-thread race condition vulnerability in the thermal management module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 6.8
CVE-2019-12919: On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via the HTTP service on port 8000. The HTTP web server on the camera allows anyone to view or download the video archive recorded and saved on the external memory card attached to the device.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-mggq-95w2-3hx4: Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory.
CVE-2020-35605: The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-8pmc-2r7m-mjxq: Buffer overflow in the SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.
GHSA-jrcj-jfvh-q4q9: Path Traversal vulnerability in ilmosys Open Close WooCommerce Store allows PHP Local File Inclusion. This issue affects Open Close WooCommerce Store: from n/a through 4.9.5.
CVSS v3.1: 8.8
RHSA-2025:8981: Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-cc32-h3p6-f962: N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c.
CVSS v3.1: 7.5
GHSA-c89f-5fw4-j48m: The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service (memory corruption) via an unspecified input.
CVSS v3.0: 7.5
GHSA-xhwj-rvxr-frx4: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 (October 2018).
GHSA-8gff-cf92-72pv: pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-rj3h-g9c2-4q52: Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action to create_account.php, or (4) entry_country_id parameter in an edit action to admin/create_account.php.
GHSA-qv4c-fxg6-m2pf: In the Linux kernel, the following vulnerability has been resolved:drm/xe/vm: Clear the scratch_pt pointer on errorAvoid triggering a dereference of an error pointer on cleanup in
xe_vm_free_scratch() by clearing any scratch_pt error pointer.(cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8)
CVSS v3.1: 5.5
CVE-2020-16280: Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating system.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-x94q-jq82-vcw5: Edraw Max 7.9.3 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a77.
CVSS v3.0: 7.5
GHSA-wq2c-7m9f-vjwv: Unrestricted file upload vulnerability in admin/upload.php in Benja CMS 0.1 allows remote attackers to upload and execute arbitrary PHP files via unspecified vectors, followed by a direct request to the file in billeder/.
CVE-2020-21014: emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
CVSS v3.1: 6.5
CVSS v2.0: 5.5
CVE-2015-0277: The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion.  NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
CVSS v2.0: 6
GHSA-xh6m-92pm-858v: The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
CVE-2019-12260: Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-r9hx-cmxm-cg5j: School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.
CVSS v3.1: 9.8
RHSA-2018:1249: Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.2
undertow: Path traversal in ServletResourceManager class undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
CVSS v3.0: 8.1
CVE-2015-9500: The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-9gqx-wxpv-w98p: Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the NetAddAlternateComputerName API.
CVE-2008-6884: Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/.
CVSS v2.0: 6.8
RHSA-2026:8346: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
nginx: NGINX ngx_mail_smtp_module vulnerability nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests NGINX: NGINX: Certificate revocation bypass when OCSP is enabled nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files
CVSS v3.1: 7.8
CVE-2023-46865: /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
CVSS v3.1: 7.2
PYSEC-2024-219: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Proxy) client and server when Gradio's `share=True` option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and read files uploaded to the Gradio server, as well as modify responses or data sent between the client and server. This impacts users who are sharing Gradio demos publicly over the internet using `share=True` without proper encryption, exposing sensitive data to potential eavesdroppers. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can avoid using `share=True` in production environments and instead host their Gradio applications on servers with HTTPS enabled to ensure secure communication.
CVSS v3.1: 9.1
GHSA-9599-89x2-g4w2: Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.1: 6.1
GHSA-j5ff-q8rv-qm43: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel memory.
CVSS v3.1: 5.5
CVE-2021-29983: Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2025-64304: "FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.
CVSS v4.0: 5.1
CVSS v3.0: 4
GHSA-wr66-4wc3-frfh: Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
CVSS v3.1: 7.5
GHSA-8r5v-vm4m-4g25: Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the
generation of reset frames on the victim endpoint.
By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion,
resulting in Out Of Memory (OOM) and high CPU usage.This fix is corrected in [hyperium/h2#737](https://github.com/hyperium/h2/pull/737), which limits the total number of
internal error resets emitted by default before the connection is closed.
CVE-2017-7148: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable.
CVSS v3.0: 3.3
CVSS v2.0: 4.3
GHSA-7x96-q5x4-9p4w: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS v3.0: 7.5
RHBA-2019:2922: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.2 Image Release Advisory
atomic-openshift: CSRF tokens not refreshing while user is logged in and are exposed in the URL
CVSS v3.0: 4.2
CVE-2020-12646: OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2021-22358: There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the service abnormal.
CVSS v3.1: 4.3
CVSS v2.0: 4
GHSA-cj7m-xpw7-hcp8: A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in command-line parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files that may contain sensitive information.
CVSS v3.1: 4.4
CVE-2024-39531: Junos OS Evolved: ACX 7000 Series: Protocol specific DDoS configuration affects other protocols
An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).

If a value is configured for DDoS bandwidth or burst parameters for any protocol in
a queue, all protocols which share the same queue will have
their bandwidth or burst value changed to the new value. If, for example, OSPF was configured with a certain bandwidth value, ISIS would also be limited to this value. So inadvertently either the control plane is open for a high level of specific traffic which was supposed to be limited to a lower value, or the limit for a certain protocol is so low that chances to succeed with a volumetric DoS attack are significantly increased. 




This issue affects Junos OS Evolved on ACX 7000 Series:



  *  All versions before 21.4R3-S7-EVO,
  *  22.1 versions before 22.1R3-S6-EVO, 
  *  22.2 versions before 22.2R3-S3-EVO,
  *  22.3 versions before 22.3R3-S3-EVO, 
  *  22.4 versions before 22.4R3-S2-EVO,
  *  23.2 versions before 23.2R2-EVO,
  *  23.4 

versions 

before 23.4R1-S1-EVO, 23.4R2-EVO.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2016-1498: Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2017-13716: The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
CVSS v3.0: 5.5
CVSS v2.0: 7.1
GHSA-9c6c-9p8c-7g7v: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.0 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.0 and earlier allows a attacker to log in to the product may execute an arbitrary command.
CVSS v3.1: 8.8
GHSA-693h-gw25-68jx: TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgi_main.
CVSS v3.1: 8.8
GHSA-vvc2-cg8v-mmjx: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-4rjc-jcg6-mw6m: SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a tnews action.
GHSA-vjfr-p6hp-jqqw: Command Injection in ungit
Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.RecommendationUpdate version 0.9.0 or later.
GHSA-wx8p-85p4-gfr8: In the Linux kernel, the following vulnerability has been resolved:firmware: arm_scmi: Fix list protocols enumeration in the base protocolWhile enumerating protocols implemented by the SCMI platform using
BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is
currently validated in an improper way since the check employs a sum
between unsigned integers that could overflow and cause the check itself
to be silently bypassed if the returned value 'loop_num_ret' is big
enough.Fix the validation avoiding the addition.
CVSS v3.1: 5.5
CVE-2018-10899: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
CVSS v3.0: 8.1
GHSA-6h4j-9hpq-prqw: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.13.1.
CVSS v3.1: 6.5
CVE-2023-21525: Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1: 5.3
ICSA-12-251-01: RealFlex RealWinDemo DLL Hijack
Multiple untrusted search path vulnerabilities in RealFlex RealWin before 2.1.13, FlexView before 3.1.86, and RealWinDemo before 2.1.13 allow local users to gain privileges via a Trojan horse (1) realwin.dll or (2) keyhook.dll file in the current working directory.
CVE-2022-41832: BIG-IP SIP vulnerability CVE-2022-41832
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource utilization.
CVSS v3.1: 7.5
CVE-2024-29770: WordPress Pretty Links plugin <= 3.6.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pretty Links Shortlinks by Pretty Links allows Reflected XSS.This issue affects Shortlinks by Pretty Links: from n/a through 3.6.2.
CVSS v3.1: 7.1
CVE-2025-4808: PHPGurukul Park Ticketing Management System add-normal-ticket.php sql injection
A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0 and classified as critical. This issue affects some unknown processing of the file /add-normal-ticket.php. The manipulation of the argument noadult/nochildren/aprice/cprice leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-4j62-mqj7-xp2q: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server.
CVE-2019-10140: A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).
CVSS v3.0: 5.5
CVE-2018-1000857: log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in User to root privilege escalation. This attack appear to be exploitable via Malicious unprivileged user executes the vulnerable binary/(remote) environment variable manipulation similar shell-shock also possible.
CVSS v3.1: 8.8
CVSS v2.0: 9