ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-46094: WordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
CVSS v3.1: 7.1
GHSA-25gv-mvm7-5h3h: Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
CVSS v3.1: 4.3
GHSA-7vvm-24cg-qmw6: Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.
CVSS v3.0: 7.5
GHSA-5gfj-9xr7-9j5r: The affix_sock_register in the Affix Bluetooth Protocol Stack for Linux might allow local users to gain privileges via a socket call with a negative protocol value, which is used as an array index.
GHSA-9m42-rhq2-5mgh: D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
CVSS v3.1: 9.8
CVE-2008-1103: Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues."
CVSS v2.0: 6.9
RHBA-2004:232: Red Hat Bug Fix Advisory: Updated lvm package
security flaw
GHSA-vh6v-4rj2-6qcq: The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
GHSA-w582-36rx-qpx6: IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4
CVSS v3.1: 5.5
GHSA-qgcc-433m-fwmc: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.
CVSS v3.1: 4.7
CVE-2024-23126: Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted CATPART file when parsed CC5Dll.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
CVE-2008-2971: SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
GHSA-p6qp-r9qf-v2m7: A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin_invt2.php. The manipulation of the argument PROTOCOLx leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-px85-vjfw-cm92: In the Linux kernel, the following vulnerability has been resolved:tracing: Correct the length check which causes memory corruptionWe've suffered from severe kernel crashes due to memory corruption on
our production environment, like,Call Trace:
[1640542.554277] general protection fault: 0000 [#1] SMP PTI
[1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G
[1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190
[1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286
[1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX:
0000000006e931bf
[1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI:
ffff9a45ff004300
[1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09:
0000000000000000
[1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12:
ffffffff9a20608d
[1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15:
696c662f65636976
[1640542.563128] FS:  00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000)
knlGS:0000000000000000
[1640542.563937] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4:
00000000003606e0
[1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[1640542.566742] Call Trace:
[1640542.567009]  anon_vma_clone+0x5d/0x170
[1640542.567417]  __split_vma+0x91/0x1a0
[1640542.567777]  do_munmap+0x2c6/0x320
[1640542.568128]  vm_munmap+0x54/0x70
[1640542.569990]  __x64_sys_munmap+0x22/0x30
[1640542.572005]  do_syscall_64+0x5b/0x1b0
[1640542.573724]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[1640542.575642] RIP: 0033:0x7f45d6e61e27James Wang has reproduced it stably on the latest 4.19 LTS.
After some debugging, we finally proved that it's due to ftrace
buffer out-of-bound access using a debug tool as follows:
[   86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000
[   86.780806]  no_context+0xdf/0x3c0
[   86.784327]  __do_page_fault+0x252/0x470
[   86.788367]  do_page_fault+0x32/0x140
[   86.792145]  page_fault+0x1e/0x30
[   86.795576]  strncpy_from_unsafe+0x66/0xb0
[   86.799789]  fetch_memory_string+0x25/0x40
[   86.804002]  fetch_deref_string+0x51/0x60
[   86.808134]  kprobe_trace_func+0x32d/0x3a0
[   86.812347]  kprobe_dispatcher+0x45/0x50
[   86.816385]  kprobe_ftrace_handler+0x90/0xf0
[   86.820779]  ftrace_ops_assist_func+0xa1/0x140
[   86.825340]  0xffffffffc00750bf
[   86.828603]  do_sys_open+0x5/0x1f0
[   86.832124]  do_syscall_64+0x5b/0x1b0
[   86.835900]  entry_SYSCALL_64_after_hwframe+0x44/0xa9commit b220c049d519 ("tracing: Check length before giving out
the filter buffer") adds length check to protect trace data
overflow introduced in 0fc1b09ff1ff, seems that this fix can't prevent
overflow entirely, the length check should also take the sizeof
entry->array[0] into account, since this array[0] is filled the
length of trace data and occupy addtional space and risk overflow.
CVSS v3.1: 9.8
CVE-2006-6777: Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via the categoryId parameter in a Portal.ShowPage action.
CVSS v2.0: 6.8
CVE-2019-5046: A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS v3.0: 8.8
GHSA-q5vv-hjfg-5v6r: YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code, disclosure of information.
CVSS v3.0: 9.8
CVE-2020-2292: Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-q9g8-9hpp-xc82: nsufficiently Protected Credentials in ActiveMQ Artemis
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
CVSS v3.1: 5.5
GHSA-5x5f-9r6q-q7mh: Apache Tomcat Sensitive Information Disclosure
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
RHSA-2009:0009: Red Hat Security Advisory: kernel security and bug fix update
kernel: linux x86_64 ia32 emulation leaks uninitialized data Linux kernel ext[234] directory corruption denial of service kernel: i915 kernel drm driver arbitrary ioremap kernel: don't allow splice() to files opened with O_APPEND kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH kernel: sctp: Fix kernel panic while process protocol violation parameter kernel: Unix sockets kernel panic
ICSA-25-191-03: Siemens TIA Administrator
The affected application improperly validates code signing certificates.
This could allow an attacker to bypass the check and exceute arbitrary code during installations. The affected application allows low-privileged users to trigger installations by overwriting cache files and modifying the downloads path. This would allow an attacker to escalate privilege and exceute arbitrary code.
CVSS v3.1: 7.8
CVE-2024-7665: SourceCodester Car Driving School Management System manage_package.php sql injection
A vulnerability classified as critical was found in SourceCodester Car Driving School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_package.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-5mmg-pg6m-wcc9: Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26237.
CVSS v3.0: 7.8
RHSA-2011:1253: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: mm: mem allocated invisible to oom_kill() when not attached to any threads kernel: sctp: a race between ICMP protocol unreachable and connect() kernel: no access restrictions of /proc/pid/* after setuid program exec kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab kernel: tpm infoleaks kernel: gro: reset dev and skb_iff on skb reuse kernel: DoS (crash) due slab corruption in inotify_init1 (incomplete fix for CVE-2010-4250) kernel: drivers/scsi/mpt2sas: prevent heap overflows kernel: drivers/scsi/mpt2sas: prevent heap overflows kernel: net: Fix memory leak/corruption on VLAN GRO_DROP kernel: corrupted GUID partition tables can cause kernel oops kernel: cifs session reuse kernel: proc: signedness issue in next_pidmap() kernel: missing check in can/bcm and can/raw socket releases kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls kernel: agp: insufficient page_count parameter checking in agp_allocate_memory() kernel: missing check in can/bcm and can/raw socket releases kernel: netns vs proto registration ordering kernel: netns vs proto registration ordering kernel: dccp: handle invalid feature options length kernel: validate size of EFI GUID partition entries kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls kernel: ksm: race between ksmd and exiting task kernel: inet_diag: insufficient validation kernel: taskstats: duplicate entries in listener mode can lead to DoS kernel: rpc task leak after flock()ing  NFS share kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace kernel: /proc/PID/io infoleak kernel: mm: avoid wrapping vm_pgoff in mremap() and stack expansions kernel: bluetooth: buffer overflow in l2cap config request kernel: nl80211: missing check for valid SSID size in scan operations kernel: ext4: kernel panic when writing data to the last block of sparse file
CVE-2023-40599: Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js.
CVSS v3.1: 7.5
GHSA-xv72-qgpm-8gw4: IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system.  IBM X-Force ID:  248415.
CVSS v3.1: 4.2
GHSA-9wc7-mj3f-74xv: Flowise: Code Injection in CSVAgent leads to Authenticated RCE
SummaryThe CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: `DataFrame({'foo': ['bar!']});import os;os.system('whoami')` that will get interpolated and executed by the server.DetailsThe code in question that introduces the issue is in [CSVAgent.ts](https://github.com/FlowiseAI/Flowise/blob/78674897270d58a7086c6c7ccefcc44a5fe9fbf6/packages/components/nodes/agents/CSVAgent/CSVAgent.ts#L157]).
`customReadCSVFunc` is user-controlled and gets interpolated directly without sanitization into the `code` variable which gets executed by `pyodide` one line later in: `dataframeColDict = await pyodide.runPythonAsync(code)`.
An authenticated attacker can issue the following chain of requests:Create a new chat flow by sending a `POST` request to `/api/v1/chatflows`. This will return the `chatflowId` in the response.Send a `POST` request to `/api/v1/prediction/[CHATFLOWID]` to trigger the execution of the chatflow. NOTE: the chatflow can contain only this node in order for the exploit to work.Optionally: send a `DELETE` request to `/api/v1/chatflows` to cleanup and delete the chat flow.Since `/chatflows` is not whitelisted [here](https://github.com/FlowiseAI/Flowise/blob/78674897270d58a7086c6c7ccefcc44a5fe9fbf6/packages/server/src/utils/constants.ts#L1), this mandates the user to be authenticated. But, if `FLOWISE_USERNAME` and `FLOWISE_PQSSWORD` aren't set, it's sufficient to provide the `"x-request-from": "internal"` header to bypass authentication.PoCHere's the PoC code:ImpactThis results in Remote Code Execution (RCE) and can allow an attacker to compromise the underlying server.
CVSS v4.0: 9.4
CVSS v3.1: 8.8
GHSA-gwcx-jrx4-92w2: Segfault in `simplifyBroadcast` in Tensorflow
ImpactThe [`simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205) is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`.PatchesWe have patched the issue in GitHub commit [35f0fabb4c178253a964d7aabdbb15c6a398b69a](https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a).The fix will be included in TensorFlow 2.8.0. This is the only affected version.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
CVSS v4.0: 8.2
CVSS v3.1: 5.9
GHSA-fjg7-227f-7rfj: Buffer overflow in Korn Shell (ksh) suid_exec program on IRIX 6.x and earlier, and possibly other operating systems, allows local users to gain root privileges.
GHSA-jf6q-9p8x-jpqh: SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVE-2015-8335: Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-m52f-r8pr-rgrx: Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
CVSS v3.0: 7.8
RHSA-2019:3217: Red Hat Security Advisory: kernel-alt security and bug fix update
kernel: MIDI driver race condition leads to a double-free kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS
CVSS v3.0: 6.2
CVE-2017-3311: Vulnerability in the Application Testing Suite component of Oracle Enterprise Manager Grid Control (subcomponent: Test Manager for Web Apps). Supported versions that are affected are 12.5.0.3, 12.5.0.2 and 12.4.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Testing Suite accessible data. CVSS v3.0 Base Score 5.3 (Integrity impacts).
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-r3xg-rg9j-67fv: Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
ImpactThe METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling:XML External Entity (XXE) attacks to read local files or cause denial of serviceDecompression bombs (zip bombs) to exhaust memory and disk spaceUnbounded archive extraction consuming system resourcesAn attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes.PatchesFixed in version 2.91.0. The fix implements:Secure XML parsing with `resolve_entities=False`, `load_dtd=False`, and `no_network=True`Configurable limits: 300 MB total extraction size, 10 MB per file, 1000 member countCumulative size tracking across all extractionsEarly termination when limits are exceededSecure format detection of METS-GBS tar archives with `_detect_mets_gbs()` method: maximum file size (10 MB per file), maximum member count (1000 members), and exception handling to gracefully fail when limits are exceededWorkaroundsAvoid processing METS-GBS archives from untrusted sources. If necessary, pre-validate archives in an isolated environment with resource limits.ReferencesFix release: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)
CVSS v3.1: 5.5
GHSA-7633-3r2w-xq8x: IrfanView RLE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of RLE files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23159.
CVSS v3.0: 7.8
GHSA-4j8w-p6hv-3qxc: Cross-Site Request Forgery (CSRF) in automad/automad
automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.
CVSS v3.1: 4.3
CVE-2007-1431: Multiple unspecified vulnerabilities in PennMUSH 1.8.3 before 1.8.3p1 and 1.8.2 before 1.8.2p3 allow attackers to cause a denial of service (crash) related to the (1) speak and (2) buy functions.
CVSS v2.0: 7.8
CVE-2007-6697: Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
ICSA-26-181-01: Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M
A heap-based buffer overflow vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to trigger a buffer overflow that may cause the affected product to enter a denial-of-service condition by convincing a legitimate user to decompress a specially crafted archive file using the affected product.  A NULL pointer dereference vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to trigger a NULL pointer dereference that may cause the affected product to enter a denial-of-service condition by convincing a legitimate user to decompress a specially crafted archive file using the affected product.  A link following vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to tamper with or destroy information by convincing a legitimate user to decompress a specially crafted archive file using the affected product. If the tampered or destroyed files are required for PC operation, the affected PC may enter a denial-of-service condition.  A path traversal vulnerability exists in the 7-Zip component included in MELSOFT Update Manager SW1DND-UDM-M. This vulnerability could allow a local attacker to execute arbitrary code by decompressing a specially crafted archive file using the affected product. As a result, the affected product may be impacted in ways such as information theft, information tampering, a denial-of-service condition, or other impacts. 
CVSS v3.1: 8.8
GHSA-4jq6-q6h2-8qqx: Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
GHSA-8wfm-7f7g-w7p4: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
CVSS v3.0: 8.2
GHSA-rgjq-vpr7-3hfm: Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS v3.1: 9.8
GHSA-94qg-6wrr-5c2r: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777.
CVE-2021-21326: Horizontal Privilege Escalation
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is fixed in version 9.5.4.
CVSS v3.1: 7.7
RHSA-2011:1100: Red Hat Security Advisory: icedtea-web security update
icedtea-web: home directory path disclosure to untrusted applications icedtea-web: Java Web Start security warning dialog manipulation