ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5w4j-f78p-4wh9: Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66
ImpactIn libcontainer, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. Code can be seen [here](https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408) . The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container.However, GHSA-f3fp-gc8g-vw66 was opened on runc mentioning that setting inherited caps in any case for tenant container can lead to elevation of capabilities. For this, they added a fix [here](https://github.com/opencontainers/runc/blob/986451c24e17c8d4be3c454f60b1f7be4af3e8b4/exec.go#L234-L242) where they never set new inherited caps on tenant, and set ambient caps only if original container had inherited caps.Similarly crun never sets inherited caps as can be seen [here](https://github.com/containers/crun/blob/3ec6298abd79e144fbf3fa6db90793ff4c0516f9/src/exec.c#L319).[!NOTE]
This does not affect youki binary itself, as the exec implementation is partially broken and does not pass on the user-provided caps to tenant containers, this is only applicable if you are using libcontainer directly and using the tenant builder.WorkaroundsDo not pass any user-provided capabilities to the tenant builder, in which case no capabilities will be set on tenant.Alternatively you can verify the capabilities of original container and filter the user passed capabilities before setting them on tenant.Referenceshttps://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66https://man7.org/linux/man-pages/man7/capabilities.7.html
CVSS v3.1: 5.9
GHSA-xw64-mvx9-6946: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
CVSS v3.1: 2.7
CVE-2017-12950: The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-q4gr-p99g-9293: Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by child_process.exec and the "<img src=# onerror='eval(new Buffer(" substring.
GHSA-xf99-4fg6-8336: Cross-site request forgery (CSRF) vulnerability in the web framework on the Cisco Identity Services Engine (ISE) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuh25506.
GHSA-8w5w-hcg8-56w5: dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214.
GHSA-2r77-x4qh-mhc3: Denial-of-service in the XML component. This vulnerability affects Firefox < 149.
CVSS v3.1: 7.5
CVE-2024-51868: WordPress DuoGeek Blocks plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tapan Kumer Das DuoGeek Blocks duogeek-blocks allows Stored XSS.This issue affects DuoGeek Blocks: from n/a through 0.1.1.
CVSS v3.1: 6.5
CVE-2016-10751: osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-g85f-5xc2-36cg: Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.
GHSA-4wqc-hc43-242v: cPanel before 70.0.23 allows any user to disable Solr (SEC-371).
CVSS v3.0: 5.5
CVE-2021-32138: The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-xqf3-q2jh-qp3h: Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.3
GHSA-rh9w-5362-2p58: A Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
CVSS v3.1: 7.8
CVE-2018-14923: A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-rpp3-6c33-vw2f: Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability."
CVSS v3.1: 8.8
GHSA-pfxq-pqj7-2jvr: A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search= leads to sql injection. It is possible to launch the attack remotely.
CVSS v3.1: 9.8
GHSA-7m9r-rq9j-wmmh: PocketMine-MP vulnerable to denial-of-service by sending large modal form responses
ImpactDue to a workaround for an old client bug (which has since been fixed), very large JSON payloads in `ModalFormResponsePacket` were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the server from processing other connections in a timely manner.PatchesThe problem has been addressed in 3baa5ab71214f96e6e7ab12cb9beef08118473b5 by removing the workaround code.WorkaroundsPlugins could cancel `DataPacketReceiveEvent` for this packet, decode the data their way, and then call `Player->onFormSubmit()` directly, bypassing the vulnerable code.
CVSS v3.1: 5.3
CVE-2022-3297: Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
CVSS v3.0: 7.8
CVE-2025-70305: A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.
CVSS v3.1: 5.5
CVE-2021-40794: Adobe Premiere Pro MOV file memory corruption vulnerability could lead to arbitrary code execution
Adobe Premiere Pro version 15.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS v3.1: 7.8
CVE-2025-11823: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2005-3961: export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter.
CVSS v2.0: 5
CVE-2018-19660: An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-qvjf-2rj3-8wrg: A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
GHSA-mhjr-7mqj-rp86: The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 8.8
GHSA-m6c2-fr93-335h: In the Linux kernel, the following vulnerability has been resolved:interconnect: fix mem leak when freeing nodesThe node link array is allocated when adding links to a node but is not
deallocated when nodes are destroyed.
CVSS v3.1: 5.5
CVE-2014-2585: ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.
CVSS v2.0: 4.9
GHSA-vgj2-gwrp-65hq: x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334).
CVSS v3.1: 8.6
GHSA-rvw8-5cm3-p38j: In the Linux kernel, the following vulnerability has been resolved:mailbox: th1520: Fix memory corruption due to incorrect array sizeThe functions th1520_mbox_suspend_noirq and th1520_mbox_resume_noirq are
intended to save and restore the interrupt mask registers in the MBOX
ICU0. However, the array used to store these registers was incorrectly
sized, leading to memory corruption when accessing all four registers.This commit corrects the array size to accommodate all four interrupt
mask registers, preventing memory corruption during suspend and resume
operations.
CVSS v3.1: 7.8
GHSA-2m7g-9m2h-fmjg: Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS v3.1: 6.1
CVE-2015-0766: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
CVSS v2.0: 4.3
CVE-2026-26235: JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication
JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-g94p-h263-c26q: Cross Site Request Forgery in Mingsoft MCMS
MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
CVSS v3.1: 8.8
GHSA-wpjc-hhm5-vq6r: The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack
CVSS v3.1: 4.3
RHSA-2020:0902: Red Hat Security Advisory: icu security update
ICU: Integer overflow in UnicodeString::doAppend()
CVSS v3.1: 8.8
CVE-2021-28374: The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids, home and/or Maildir directory, quota, and some type of password information (such as a hash).
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-47759: MTPutty 1.0.1.21 - SSH Password Disclosure
MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerShell process listing. Attackers can run a PowerShell command to retrieve the full command line of MTPutty processes, exposing plaintext SSH credentials.
CVSS v4.0: 6.8
CVSS v3.1: 6.2
RHSA-2022:6058: Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update
dotnet: External Entity Injection during XML signature verification
CVSS v3.1: 5.9
CVE-2007-0516: Yana Framework before 2.8.5a allows remote authenticated users with permissions to modify a guestbook profile to modify or delete arbitrary guestbook profiles via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 4.9
CVE-2000-0990: cmd5checkpw 0.21 and earlier allows remote attackers to cause a denial of service via an "SMTP AUTH" command with an unknown username.
CVSS v2.0: 7.5
CVE-2007-2100: FAC Guestbook 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/Gdb.mdb.
CVSS v2.0: 10
GHSA-fxww-g9ff-h2wm: Unspecified vulnerability in the Mac OS X kernel before 10.3.8 allows local users to cause a denial of service (temporary hang) via unspecified attack vectors related to the fan control unit (FCU) driver.
GHSA-hcqx-rg27-pcqw: A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1261.
GHSA-8q7m-mjrr-jr45: The virtual memory implementation in Linux kernel 2.6.x allows local users to cause a denial of service (panic) by running lsof a large number of times in a way that produces a heavy system load.
GHSA-v6mg-69hj-52gp: Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.1 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted message over TCP.
CVE-2026-42159: Flowsint: Stored XSS in description of node
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
CVSS v4.0: 5.3
GHSA-q4jf-gp35-367g: In the Linux kernel, the following vulnerability has been resolved:sctp: disable BH before calling udp_tunnel_xmit_skb()udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with
BH disabled.  After commit 6f1a9140ecda ("add xmit recursion limit to
tunnel xmit functions"), on the path:udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.Without local_bh_disable(), the context may move between CPUs, which can
break the inc/dec pairing. This may lead to incorrect recursion level
detection and cause packets to be dropped in ip(6)_tunnel_xmit() or
__dev_queue_xmit().Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.In my testing, after enabling the SCTP over UDP:ip net exec ha sysctl -w net.sctp.udp_port=9899ip net exec ha sysctl -w net.sctp.encap_port=9899ip net exec hb sysctl -w net.sctp.udp_port=9899ip net exec hb sysctl -w net.sctp.encap_port=9899ip net exec ha iperf3 -swithout this patch:ip net exec hb iperf3 -c 192.168.0.1 --sctp[  5]   0.00-10.00  sec  37.2 MBytes  31.2 Mbits/sec  sender
[  5]   0.00-10.00  sec  37.1 MBytes  31.1 Mbits/sec  receiverwith this patch:ip net exec hb iperf3 -c 192.168.0.1 --sctp[  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  sender
[  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  receiver
CVSS v3.1: 7.5
CVE-2026-42250: Off-by-One Leading to Out-of-Bounds Write in bzip2
bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
CVSS v4.0: 4.8
GHSA-wgjq-hm36-r7r8: nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build.
CVSS v3.1: 9.8
CVE-2023-41504: SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.
CVSS v3.1: 8.8
GHSA-rqqc-5wmj-43vx: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn – WordPress Posts Table Filterable allows Stored XSS. This issue affects TableOn – WordPress Posts Table Filterable: from n/a through 1.0.3.
CVSS v3.1: 7.1
CVE-2025-66087: WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability
Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
CVSS v3.1: 4.3
GHSA-4hqj-gqq3-2qr6: A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system.
CVSS v3.1: 7.8
CVE-2018-20928: cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2018-1621: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346.
CVSS v3.0: 4.4
GHSA-75wr-64hp-88pq: The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read.
CVE-2002-1548: Unknown vulnerability in autofs on AIX 4.3.0, when using executable maps, allows attackers to execute arbitrary commands as root, possibly related to "string handling around how the executable map is called."
CVSS v2.0: 7.2
CVE-2020-24486: Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2006-3625: FLV Players 8 allows remote attackers to obtain sensitive information via (1) a direct request to paginate.php or (2) an invalid p parameter to player.php, which reveal the path in an error message.
CVSS v2.0: 5
CVE-2016-1670: Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a request ID.
CVSS v3.0: 5.3
CVSS v2.0: 2.6
GHSA-rxfq-vp39-8cc6: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Agustin Berasategui AB Categories Search Widget allows Reflected XSS.This issue affects AB Categories Search Widget: from n/a through 0.2.5.
CVSS v3.1: 7.1
CVE-2020-4702: IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.
CVSS v3.0: 6.4
GHSA-q6rw-39p5-wphc: Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
CVSS v3.1: 8.8
CVE-2021-38005: Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2018-1639: The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.
CVSS v3.0: 4.3
CVE-2017-5830: Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2021-1020: In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195111725
CVSS v3.1: 7.3
CVSS v2.0: 4.4
GHSA-fhj8-953f-fx7h: Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname.
CVE-2011-4834: The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
CVSS v2.0: 4.6
GHSA-95qc-g5wc-qh7x: ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
GHSA-5xqw-m34m-7pc3: Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request.