ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2009-3455: Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS v2.0: 7.5
CVE-2016-3931: drivers/misc/qseecom.c in the Qualcomm QSEE Communicator driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29157595 and Qualcomm internal bug CR 1036418.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
ICSA-20-252-06: Siemens SIMATIC HMI Products (Update A)
Affected devices insufficiently block excessive authentication attempts.

This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string.

This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
CVSS v3.1: 5.3
GHSA-cqm8-rg2p-jfcf: Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
CVSS v3.1: 5.5
CVE-2021-47981: Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form
Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute arbitrary JavaScript in victim browsers when the form is submitted.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-8vvf-2g79-4gqm: A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
CVSS v3.1: 8.8
CVE-2022-50465: ext4: fix leaking uninitialized memory in fast-commit journal
In the Linux kernel, the following vulnerability has been resolved:

ext4: fix leaking uninitialized memory in fast-commit journal

When space at the end of fast-commit journal blocks is unused, make sure
to zero it out so that uninitialized memory is not leaked to disk.
CVSS v3.1: 5.5
GHSA-rr2j-63gw-g4xf: A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the file /addprojectsale.php. The manipulation of the argument amen results in sql injection. The attack can be launched remotely.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-ff4f-6x55-3ppq: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
CVE-2017-0614: An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399405. References: QC-CR#1080290.
CVSS v3.0: 7
CVSS v2.0: 7.6
CVE-1999-0992: HP VirtualVault with the PHSS_17692 patch allows unprivileged processes to bypass access restrictions via the Trusted Gateway Proxy (TGP).
CVSS v2.0: 10
GHSA-2r5w-jh6g-8hff: A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
CVSS v3.1: 5.4
GHSA-wxfc-g96x-mm56: The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
CVSS v3.0: 9.8
CVE-2019-0145: Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-x5jp-xv66-68wp: PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tc_config[app_root] parameter.
CVE-2015-2951: JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens.
CVSS v2.0: 5
CVE-2013-4263: libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.
CVSS v2.0: 7.5
CVE-2021-0351: In wlan driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11; Patch ID: ALPS05412917.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
CVE-2017-14460: An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability.
CVSS v3.0: 7.5
CVE-2024-45066: Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP 
sub-menu can allow a remote attacker to inject arbitrary commands.
CVSS v4.0: 10
CVSS v3.1: 10
GHSA-5v3q-4g69-424q: ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
CVE-2023-4161: WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can trick an admin into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2024-53878: NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
CVSS v3.1: 2.8
CVE-2008-7005: include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotes_to_edit parameter.  NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential consequence of code execution.
CVSS v2.0: 7.5
CVE-2022-34917: Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
CVSS v3.1: 7.5
CVE-2009-1334: Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote attackers to inject arbitrary web script or HTML via the reason parameter.
CVSS v2.0: 4.3
CVE-2026-10997: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS v3.1: 6.5
GHSA-4gc6-9xr6-qwc7: Integer overflow in the AudioInputRendererHost::OnCreateStream function in content/browser/renderer_host/media/audio_input_renderer_host.cc in Google Chrome before 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.
CVE-2021-41497: Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Denial of Service attacks by inputting a huge width of hash bucket.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-43460: An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService service executable path.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-3pp4-64mp-9cg9: Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`
Affected versions of this crate maintains references to memory that might have been freed already.
If affects the following two `tremor-script` language constructs:A [Merge](https://www.tremor.rs/docs/tremor-script/index#merge) where we assign the result back to the target expression
and the expression to be merged needs to reference the `event`:A [Patch](https://www.tremor.rs/docs/tremor-script/index#patch) where we assign the result back to the target expression
and the patch operations used need to reference the `event`:For constructs like this (it doesnt matter what is references in the expression to be merged or the patch operations) an optimization
was applied to manipulate the target value in-place, instead of cloning it.Our `Value` struct which underpins all event data in `tremor-script`, is representing as borrowed strings `beef::Cow<'lifetime, str>` 
that reference the actual `Vec<u8>` the event is based upon. We keep the raw byte-array next to the event structure inside our `Event` struct as a self-referential struct,
so we make sure that the structured `Value` and its references are valid across its whole lifetime.The optimization was considered safe as long as it was only possible to merge or patche `event` data or static data.
When `state` was introduced to `tremor-script` a new possibility existed, to keep `Value` data around for longer than the lifetime of an event.
If `event` data is merged or patched into `state` without cloning `state` first, it can still reference keys or values from
the previous event, which will now be invalid. This allows access to those already freed regions of memory and to get their content out over the wire.WorkaroundIf an upgrade is not possible, a possible workaround is to avoid the optimization
by introducing a temporary variable and not immediately reassigning to `state`:FixThe flaw was corrected in `tremor-script` version 0.11.6 via commit [1a2efcd](https://github.com/tremor-rs/tremor-runtime/commit/1a2efcdbe68e5e7fd0a05836ac32d2cde78a0b2e) by removing the optimization
and always clone the target expression of a [Merge](https://www.tremor.rs/docs/tremor-script/index#merge) or [Patch](https://www.tremor.rs/docs/tremor-script/index#patch.
GHSA-2f6x-v9qj-8f54: The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.
ICSA-17-187-03F: ICSA-17-187-03F Siemens SIPROTEC 4 and SIPROTEC Compact (Update F)
Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain sensitive device information if network access was obtained. The integrated web server (port 80/tcp) of the affected devices could allow remoteattackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. Specially crafted packets sent to port 80/tcp could cause the affected device to go into defect mode. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. A legitimate user must be logged into the web interface for the attack to be successful.
CVSS v3.0: 4.3
RHSA-2025:13961: Red Hat Security Advisory: kernel-rt security update
kernel: drm/vkms: Fix memory leak in vkms_init() kernel: drm/vkms: Fix null-ptr-deref in vkms_release() kernel: drm/vkms: Fix use after free and double free on init error kernel: net_sched: ets: Fix double list add in class with netem as child qdisc kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush()
CVSS v3.1: 7.3
RHSA-2011:1384: Red Hat Security Advisory: java-1.6.0-sun security update
HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST) JDK: unspecified vulnerability fixed in 6u29 (Deployment) OpenJDK: IIOP deserialization code execution (Deserialization, 7055902) OpenJDK: missing SecurityManager checks in scripting engine (Scripting, 7046823) JDK: unspecified vulnerability fixed in 6u29 (Sound) JDK: unspecified vulnerability fixed in 6u29 (Deployment) OpenJDK: InputStream skip() information leak (Networking/IO, 7000600) OpenJDK: mutable static AWTKeyStroke.ctor (AWT, 7019773) JDK: unspecified vulnerability fixed in 6u29 (Swing) JDK: unspecified vulnerability fixed in 6u29 (AWT) OpenJDK: Java2D TransformHelper integer overflow (2D, 7023640) OpenJDK: excessive default UDP socket limit under SecurityManager (Networking, 7032417) OpenJDK: JAX-WS stack-traces information leak (JAX-WS, 7046794) OpenJDK: insufficient pack200 JAR files uncompress error checks (Runtime, 7057857) OpenJDK: RMI DGC server remote code execution (RMI, 7077466) OpenJDK: RMI registry privileged code execution (RMI, 7083012) OpenJDK: Hotspot unspecified issue (Hotspot, 7070134) OpenJDK: missing checkSetFactory calls in HttpsURLConnection (JSSE, 7096936) JDK: unspecified vulnerability fixed in 6u29 (Deployment)
CVE-2023-5263: ZZZCMS Database Backup File save.php restore permission
A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the component Database Backup File Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240872.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2021-36848: WordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4
CVSS v3.1: 3.4
GHSA-92mr-4w2q-4578: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
CVSS v3.0: 9.8
GHSA-hgrq-rjwf-5f46: Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via a crafted .exe, .sys, and .dll files.
CVSS v3.1: 7.8
GHSA-v89h-g8w6-9crx: A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2012-1163: Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.
CVSS v2.0: 6.8
CVE-2022-23898: MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-pfcx-qjhq-rrfp: WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
CVE-2017-2401: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2008-2127: Cross-site scripting (XSS) vulnerability in search.php in CMS Faethon 2.2 Ultimate allows remote attackers to inject arbitrary web script or HTML via the what parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 4.3
GHSA-4vj3-f849-5r48: Arbitrary File Read in Snyk Broker
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
CVSS v3.1: 6.5
CVE-2021-29397: Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-m7r5-29r2-m6xh: A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The password in configuration file vulnerability could allow a malicious user to escalate privileges or assume the identity of another user and access sensitive information.
CVSS v3.0: 8.8
GHSA-78m6-w6r4-m4h9: fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.
CVE-2022-39104: In contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with no additional execution privileges needed.
CVSS v3.1: 5.5
GHSA-3p98-4wm7-qj6w: Missing Authorization vulnerability in ThimPress WP Events Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Events Manager: from n/a through 2.2.1.
CVSS v3.1: 5.3
CVE-2004-0311: American Power Conversion (APC) Web/SNMP Management SmartSlot Card 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, which allows remote attackers to gain unauthorized access.
CVSS v2.0: 10
GHSA-x3h6-r5xc-mc8q: Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
GHSA-qqq7-4hxc-x63c: OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration
ImpactShared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration.A crafted shared reply MEDIA reference could cause another channel to read a local file path as trusted generated media.OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.Affected Packages / VersionsPackage: `openclaw` (npm)Affected versions: `<=2026.4.4`Patched versions: `2026.4.8`FixThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.VerificationThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.CreditsThanks @threalwinky for reporting.
CVSS v4.0: 5.1
CVSS v3.1: 5