ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-11345: Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devices
A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
CVSS v3.1: 7.3
GHSA-wm8j-hgw9-h534: IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system.
CVSS v3.1: 5.3
CVE-2002-0275: Falcon web server 2.0.0.1020 and earlier allows remote attackers to bypass authentication and read restricted files via an extra / (slash) in the requested URL.
CVSS v2.0: 5
CVE-2023-50876: WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3.
CVSS v3.1: 4.3
GHSA-g3rq-2957-28ch: The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests, aka Bug ID CSCur25513.
CVSS v3.0: 8.8
GHSA-h2qh-wp73-v6c9: DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.
CVE-2025-38530: comedi: pcl812: Fix bit shift out of bounds
In the Linux kernel, the following vulnerability has been resolved:

comedi: pcl812: Fix bit shift out of bounds

When checking for a supported IRQ number, the following test is used:

	if ((1 << it->options[1]) & board->irq_bits) {

However, `it->options[i]` is an unchecked `int` value from userspace, so
the shift amount could be negative or out of bounds.  Fix the test by
requiring `it->options[1]` to be within bounds before proceeding with
the original test.  Valid `it->options[1]` values that select the IRQ
will be in the range [1,15]. The value 0 explicitly disables the use of
interrupts.
CVSS v3.1: 7.1
CVE-2011-3557: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
CVSS v2.0: 6.8
RHSA-2013:1812: Red Hat Security Advisory: firefox security update
Mozilla: Out-of-bounds read in image rendering (MFSA 2013-22) Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104) Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106) Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114) Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107) Mozilla: Use-after-free in event listeners (MFSA 2013-108) Mozilla: Use-after-free during Table Editing (MFSA 2013-109) Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111)
CVE-2005-4377: Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) PageID and (2) SiteNodeID parameters.
CVSS v2.0: 4.3
CVE-2006-6811: KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) server, which causes an assertion failure and results in a NULL pointer dereference.  NOTE: this issue was originally reported as a buffer overflow.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-4hxv-57v2-52jp: WebKit in Google Chrome before Blink M11 contains a bad cast to RenderBlock when anonymous blocks are renderblocks.
CVE-2005-0605: scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.
CVSS v2.0: 7.5
CVE-2019-10420: Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-pcqx-8qww-7f4v: OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources
A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
CVSS v3.1: 9.1
GHSA-2497-6pwj-pwg7: Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
ImpactAn authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified.PatchesThis has been fixed in 5.73.23 and 6.20.0.
CVSS v3.1: 4.3
GHSA-5wjc-c32v-25gw: There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a denial of service attack (service interruption) via a crafted network setting interface request.
CVSS v3.0: 7.5
GHSA-88r5-mxjg-5m25: Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server.
CVSS v3.0: 5.9
CVE-2024-10106: Ember ZNet buffer overflow in 'packet handoff' plugin
A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.
CVSS v3.1: 3.7
GHSA-4m29-hpfx-hxjv: A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2012-6570: The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field, which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.
CVSS v2.0: 10
GHSA-7j57-9v54-xwjr: SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run().
CVSS v3.1: 9.8
GHSA-9xmp-hxpj-pffc: Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network
CVSS v4.0: 8.7
GHSA-3633-g6mg-p6qq: SurrealDB memory exhaustion via string::replace using regex
An authenticated user can craft a query using the `string::replace` function that uses a Regex to perform a string replacement. As there is a failure to restrict the resulting string length, this enables an attacker to send a `string::replace` function to the SurrealDB server exhausting all the memory of the server due to string allocations. This eventually results in a Denial-of-Service situation for the SurrealDB server.This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53. Using CVSSv4 definitions, the severity is High.ImpactAn authenticated user can crash the SurrealDB instance through memory exhaustionPatchesA patch has been created that enforces a limit on string length  `SURREAL_GENERATION_ALLOCATION_LIMIT`Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issueWorkaroundsAffected users who are unable to update may want to limit the ability of untrusted clients to run the `string::replace` function in the affected versions of SurrealDB using the `--deny-functions` flag described within [Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#functions) or the equivalent `SURREAL_CAPS_DENY_FUNC` environment variable.References[SurrealQL Documentation - DB Functions (string::replace)](https://surrealdb.com/docs/surrealql/functions/database/string#stringreplace)
[SurrealDB Documentation - Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#functions)
[SurrealDB Documentation - Environment Variables](https://surrealdb.com/docs/surrealdb/cli/env)
[#5619 ](https://github.com/surrealdb/surrealdb/pull/5619)
[#5638 ](https://github.com/surrealdb/surrealdb/pull/5638)
CVSS v4.0: 7.1
CVE-2025-68590: WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.
CVSS v3.1: 7.6
GHSA-cmvv-49j4-8gj6: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.
CVSS v3.1: 6.7
GHSA-9gq6-2mjq-v47h: Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
GHSA-6q68-4mvp-pg9m: SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.0: 8.8
CVE-2019-8676: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
CVE-2024-52028: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1: 5.7
CVE-2024-50919: Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution
CVSS v3.1: 9.8
GHSA-5cv7-h7gr-wjgh: An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
CVSS v3.1: 7.1
GHSA-39r6-8m72-v2p6: In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVSS v3.1: 5.5
GHSA-c877-3vrh-rhqh: vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.
GHSA-2w5m-hw3j-83fq: In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
CVSS v3.1: 7.2
CVE-2020-0004: In generateCrop of WallpaperManagerService.java, there is a possible sysui crash due to image exceeding maximum texture size. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120847476
CVSS v3.1: 5.5
CVSS v2.0: 4.9
GHSA-4ww3-7pf6-6cmg: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request.
CVSS v3.0: 8.8
CVE-2018-4859: A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the web interface. The attacker must be authenticated as administrative user to exploit the security vulnerability. The vulnerability could allow an attacker to execute arbitrary code on the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS v3.0: 7.2
CVSS v2.0: 9
RHSA-2010:0893: Red Hat Security Advisory: kernel security and bug fix update
kernel: nfsd4: bug in read_buf
RHSA-2011:1292: Red Hat Security Advisory: jakarta-commons-daemon-jsvc security update
jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser
CVE-2021-38298: Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-r248-wpg2-5hw4: The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
CVSS v3.0: 5.5
GHSA-p72w-r6fv-6g5h: druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j.
This could allow an attacker to manipulate a pac4j session cookie.This issue affects Apache Druid versions 0.18.0 through 30.0.0.
Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this vulnerability.While we are not aware of a way to meaningfully exploit this flaw, we nevertheless recommend upgrading to version 30.0.1 or higher which fixes the issue and ensuring you have a strong druid.auth.pac4j.cookiePassphrase as a precaution.
CVSS v4.0: 1.7
CVSS v3.1: 3.7
CVE-2024-10220: Arbitrary command execution through gitRepo volume
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
CVSS v3.1: 8.1
CVE-2025-35432: CISA Thorium does not rate limit account verification email messages
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVE-2024-9098: Privilege Escalation in lunary-ai/lunary
In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from inviting users with billing roles. As a result, admins can circumvent the intended access control, posing a risk to the organization's financial resources.
CVSS v3.0: 7.3
GHSA-v7hw-97p7-x4mg: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-x8p9-278c-xp3q: Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed bm message.
CVE-2026-23826: Unauthenticated Denial of Service in AOS-8 Network Management Service
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.
CVSS v3.1: 7.5
CVE-2021-1236: Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.
CVSS v3.0: 4
CVE-2009-3374: The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via unspecified method calls, related to "doubly-wrapped objects."
CVSS v2.0: 7.5
CVE-2009-3413: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2008-3976 and CVE-2009-3414.
CVSS v2.0: 3.2
RHSA-2025:8594: Red Hat Security Advisory: thunderbird security update
thunderbird: Sender Spoofing via Malformed From Header in Thunderbird thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking
CVSS v3.1: 6.5
GHSA-6jp6-9w8r-589w: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 5.5
CVE-2018-6822: In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as root.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-p9r9-2rg5-9f9p: Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
GHSA-vm86-9jrr-2v8f: The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a buffer overflow in the "show log cli" command. This could be used by a read-only user (monitor role) to gain privileged (root) code execution on the switch via command injection.
CVSS v3.0: 9.8
GHSA-f87c-pf4j-94xf: Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition.
CVSS v3.1: 9.8
GHSA-xpv7-p5h9-8rgm: A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform configuration changes on the affected device, resulting in a denial of service (DoS) condition.
CVSS v3.1: 8.1
GHSA-2q54-4w4q-ghg2: Mdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plus versions earlier than 8.0.0.357(C00) has a buffer overflow vulnerability. The driver does not sufficiently validate the input, an attacker could trick the user to install a malicious application which would send crafted parameters to the driver. Successful exploit could cause a denial of service condition.
CVSS v3.0: 5.5
CVE-2015-3123: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
CVSS v2.0: 10
RHEA-2021:0729: Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images
golang-github-buger-jsonparser: infinite loop via a Delete call node-fetch: size of data after fetch() JS thread leads to DoS helm: Chart.yaml is not properly sanitized lead to injection of unwanted information into chart helm: write access to the index file allows an attacker to inject  bad chart into  repository helm: plugin names are not sanitized properly helm: write access to the git repository or plugin archive causing causing a local execution attack jsonparser: GET call can lead to a slice bounds out of range redisgraph: NULL pointer dereference because it mishandles an unquoted string
CVSS v3.1: 7.5
GHSA-prvw-wjc6-4gf5: Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request.
CVSS v3.1: 6.5
CVE-2025-67945: WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.
CVSS v3.1: 9.3
RHSA-2007:0983: Red Hat Security Advisory: conga security, bug fix, and enhancement update
ricci is vulnerable to a connect DoS attack
GHSA-j9v8-h4rq-56rx: Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter.
GHSA-fjpq-f574-jc45: Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation
Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation.This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to effectively list the Jenkins controller file system.As of publication of this advisory, there is no fix.
CVSS v3.1: 4.3
GHSA-9q6x-q4vg-q8rg: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
CVSS v3.1: 9.8