ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-31236: An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
GHSA-72hg-59hj-6gpg: Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder allows Cross Site Request Forgery. This issue affects Live Sports Streamthunder: from n/a through 2.1.
CVSS v3.1: 4.3
CVE-2023-42844: This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website may be able to access sensitive user data when resolving symlinks.
CVSS v3.1: 7.5
GHSA-29rh-32p4-4934: A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands.
CVSS v3.1: 6.7
CVE-2020-1308: DirectX Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p>
<p>The update addresses the vulnerability by correcting how DirectX handles objects in memory.</p>
CVSS v3.1: 7
GHSA-v4mq-pmm6-wq4x: SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
CVSS v3.0: 9.8
GHSA-5j7c-4mf2-vr4c: The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
GHSA-cvx9-v8g6-qm46: Azure Machine Learning Information Disclosure Vulnerability
CVSS v3.1: 6.5
CVE-2022-29532: An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-2022-50894: VIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php
VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parameter. Attackers can send GET requests to edit_gallery_image.php with malicious img_id values to extract database information.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2024-48239: An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting (XSS).
CVSS v3.1: 4.8
CVE-2024-45444: Access permission verification vulnerability in the WMS module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 5.5
CVE-2023-20850: In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340381.
CVSS v3.1: 6.5
GHSA-cw3c-gjjq-m9c4: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows remote attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK, a different vulnerability than CVE-2012-0555, CVE-2012-0556, and CVE-2012-0557.
CVE-2008-3790: The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
CVSS v2.0: 5
CVE-2023-25040: WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
CVSS v3.1: 6.5
CVE-2019-20709: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before 2.3.2.32.
CVSS v3.0: 7.1
GHSA-9536-w4xw-wvwr: The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted data, as demonstrated by a large height attribute of an IFRAME element rendered by Safari, aka "GDI Access Violation Vulnerability."
CVE-2023-6278: Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
CVE-2026-39383: Gotenberg unauthenticated blind SSRF via unfiltered webhook URL
Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. 

This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe.

This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.
CVSS v4.0: 6.9
CVE-2019-14371: An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset and tag.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-wx76-jwh7-h7gq: Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVSS v3.1: 7.8
GHSA-5852-phmh-8fhr: Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
CVSS v3.1: 8.2
CVE-2024-10756: PHPGurukul Online Shopping Portal html_table.php cross site scripting
A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/assets/plugins/DataTables/media/unit_testing/templates/html_table.php. The manipulation of the argument scripts leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-fm65-7j3c-jcv3: Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
CVSS v3.1: 9.3
GHSA-hh6w-9c5q-qw82: The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.
RHSA-2018:0464: Red Hat Security Advisory: kernel security and bug fix update
hw: cpu: speculative execution bounds-check bypass hw: cpu: speculative execution permission faults handling
CVSS v3.0: 5.5
CVE-2024-27946: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files overwrites files with the same name in the 
installation directory of the affected systems. The filename for 
the target file can be specified, thus arbitrary files can be 
overwritten by an attacker with the required privileges.
CVSS v3.1: 6.5
RHSA-2025:15035: Red Hat Security Advisory: kernel security update
kernel: can: peak_usb: fix use after free bugs kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead kernel: padata: fix UAF in padata_reorder kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() kernel: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice kernel: crypto: algif_hash - fix double free in hash_accept kernel: sch_hfsc: make hfsc_qlen_notify() idempotent kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() kernel: net/sched: Always pass notifications when child class becomes empty kernel: net/sched: ets: use old 'nbands' while purging unused classes
CVSS v3.1: 5.2
CVE-2020-4249: IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect authorization. IBM X-Force ID: 175485.
CVSS v3.0: 6.5
CVE-2024-34130: Acrobat Android : OverSecured Finding : Access to arbitrary* content providers via insecure Intent configuration
Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access confidential information. Exploitation of this issue does not require user interaction.
CVSS v3.1: 5.5
CVE-2020-12624: The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2021-30992: This issue was addressed with improved handling of file metadata. This issue is fixed in iOS 15.2 and iPadOS 15.2. A user in a FaceTime call may unexpectedly leak sensitive user information through Live Photos metadata.
CVSS v3.1: 5.5
CVSS v2.0: 1.9
GHSA-xxvc-6xwm-7prp: A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escalate their privileges via a vulnerable COM interface in the target service.
CVSS v3.1: 7.8
GHSA-gwm9-m7h8-rhm9: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
CVSS v3.0: 5.3
GHSA-hhw5-9q3f-7w82: A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.0.4 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
GHSA-vq72-2m4q-6x78: An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php
GHSA-m44h-7xq3-2hh7: Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.
CVSS v3.1: 8.8
GHSA-jhfq-cfj3-rm7v: In the Linux kernel, the following vulnerability has been resolved:tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearerThe reproduction steps:create a tun interfaceenable l2 bearerTIPC_NL_UDP_GET_REMOTEIP with media name set to tuntipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer <eth:syz_tun>, priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0the ub was in fact a struct dev.when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
other media when other thread changes it.fix this by checking media_id.
CVSS v3.1: 5.5
CVE-2024-52902: IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.
CVSS v3.1: 8.8
cisco-sa-20190605-webexmeetings-id: Cisco Webex Meetings Server Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information.

The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to access sensitive system information.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-webexmeetings-id ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-webexmeetings-id"]
CVSS v3.0: 5.3
CVE-2015-0594: Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun18263.
CVSS v2.0: 4.3
CVE-2023-30774: A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.
CVSS v3.1: 5.5
CVE-2008-3346: SQL injection vulnerability in product_detail.php in ShopCart DX allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS v2.0: 7.5
CVE-2001-1398: Masquerading code for Linux kernel before 2.2.19 does not fully check packet lengths in certain cases, which may lead to a vulnerability.
CVSS v2.0: 7.5
GHSA-fhxr-6q8q-x43m: Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.
CVSS v3.1: 5.3
GHSA-hwj3-v9vw-g5g2: Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend allows Stored XSS. This issue affects AF Tell a Friend: from n/a through 1.4.
CVSS v3.1: 7.1
CVE-2007-3717: rcp on Sun Solaris 8, 9, and 10 before 20070710 does not properly call certain helper applications, which allows local users to gain privileges by creating files with certain names, possibly containing shell metacharacters or spaces, a similar issue to CVE-2006-0225.
CVSS v2.0: 6.9
GHSA-gvcc-mwhq-ccvw: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS v3.1: 9.8
RHSA-2018:1113: Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
QEMU: vga: OOB read access during display update QEMU: VGA: reachable assert failure during display update QEMU: Slirp: use-after-free when sending response Qemu: stack buffer overflow in NBD server triggered via long export name qemu: DoS via large option request Qemu: memory exhaustion through framebuffer update request message in VNC server QEMU: I/O: potential memory exhaustion via websock connection to VNC Qemu: Out-of-bounds read in vga_draw_text routine
CVSS v3.0: 3
CVE-2020-16269: radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-vrwq-6v5h-49vq: Mirrored regions with different values in 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.
CVSS v4.0: 6.7
CVSS v3.1: 6
GHSA-492j-3fv4-2qx4: An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via supplying a crafted LL_PAUSE_ENC_REQ packet.
CVSS v3.1: 6.5
RHSA-2016:0078: Red Hat Security Advisory: bind security update
bind: delegation handling denial of service bind: TKEY query handling flaw leading to denial of service bind: malformed DNSSEC key failed assertion denial of service bind: responses with a malformed class attribute can trigger an assertion failure in db.c
CVE-2008-2293: admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain privileges by setting the CommentSystemAdmin cookie to 1.
CVSS v2.0: 7.5
GHSA-jccc-2hj6-5h7m: A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted file to the affected system. An exploit could allow the attacker to elevate privileges to root-level privileges.
GHSA-rfqm-jp7w-mhx8: Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed.
CVSS v3.1: 5.4
CVE-2017-11392: Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2021-30601: Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2018-7752: GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
ICSA-22-195-15: Siemens SIMATIC eaSie Core Package
The affected systems do not properly validate input that is sent to the underlying message passing framework. This could allow a remote attacker to trigger a denial of service of the affected system. The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.
CVSS v3.1: 10
CVE-2026-53916: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.


An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. 
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
GHSA-g79c-8pc3-xg93: Stack-based buffer overflow in CGIOCommon.dll before 8.0.0.1042 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to execute arbitrary code via long crafted requests, as demonstrated using a long session cookie to unspecified CGI programs that use this library.
CVE-2016-1000217: Zotpress plugin for WordPress SQLi in zp_get_account()
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-g9c8-phh2-8fqc: In the Linux kernel, the following vulnerability has been resolved:nilfs2: fix potential hang in nilfs_detach_log_writer()Syzbot has reported a potential hang in nilfs_detach_log_writer() called
during nilfs2 unmount.Analysis revealed that this is because nilfs_segctor_sync(), which
synchronizes with the log writer thread, can be called after
nilfs_segctor_destroy() terminates that thread, as shown in the call trace
below:nilfs_detach_log_writer
  nilfs_segctor_destroy
    nilfs_segctor_kill_thread  --> Shut down log writer thread
    flush_work
      nilfs_iput_work_func
        nilfs_dispose_list
          iput
            nilfs_evict_inode
              nilfs_transaction_commit
                nilfs_construct_segment (if inode needs sync)
                  nilfs_segctor_sync  --> Attempt to synchronize with
                                          log writer thread
                           *** DEADLOCK ***Fix this issue by changing nilfs_segctor_sync() so that the log writer
thread returns normally without synchronizing after it terminates, and by
forcing tasks that are already waiting to complete once after the thread
terminates.The skipped inode metadata flushout will then be processed together in the
subsequent cleanup work in nilfs_segctor_destroy().
CVSS v3.1: 5.3
GHSA-8r5p-7p54-pqjv: Unspecified vulnerability in SemanticScuttle before 0.90 has unknown impact and attack vectors related to improper validation of parameters to profile.php.
GHSA-8cr8-whqv-vm3j: In the Linux kernel, the following vulnerability has been resolved:scsi: scsi_transport_sas: Fix error handling in sas_phy_add()If transport_add_device() fails in sas_phy_add(), the kernel will crash
trying to delete the device in transport_remove_device() called from
sas_remove_host().Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108
CPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc1+ #173
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : device_del+0x54/0x3d0
lr : device_del+0x37c/0x3d0
Call trace:
 device_del+0x54/0x3d0
 attribute_container_class_device_del+0x28/0x38
 transport_remove_classdev+0x6c/0x80
 attribute_container_device_trigger+0x108/0x110
 transport_remove_device+0x28/0x38
 sas_phy_delete+0x30/0x60 [scsi_transport_sas]
 do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas]
 device_for_each_child+0x68/0xb0
 sas_remove_children+0x40/0x50 [scsi_transport_sas]
 sas_remove_host+0x20/0x38 [scsi_transport_sas]
 hisi_sas_remove+0x40/0x68 [hisi_sas_main]
 hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw]
 platform_remove+0x2c/0x60Fix this by checking and handling return value of transport_add_device()
in sas_phy_add().
CVSS v3.1: 5.5
CVE-2001-0357: FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters.
CVSS v2.0: 7.5