ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-8hp8-9fhr-pfm9: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
SummaryThe `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access.DetailsThe vulnerability arises from an inconsistency between the `ReadOneWeb` and `ReadAllWeb` generic handlers and the `LinkSharing` permission model.**`LinkSharing.CanRead()` correctly blocks link share users** (`pkg/models/link_sharing_permissions.go:25-29`):**`ReadOneWeb` calls `CanRead()` before returning data** (`pkg/web/handler/read_one.go:64`):**`ReadAllWeb` does NOT call `CanRead()`** (`pkg/web/handler/read_all.go:106`):**`LinkSharing.ReadAll()` only checks project-level read access** (`pkg/models/link_sharing.go:228-236`):**`Project.CanRead()` allows link share users** (`pkg/models/project_permissions.go:105-108`):The `Hash` field is exposed in JSON serialization (`pkg/models/link_sharing.go:50`):While the `Password` field is cleared at line 276, the `Hash` — which is the secret token used to authenticate — is returned in full.PoC**Prerequisites:** A project with multiple link shares at different permission levels (common scenario: a read-only share for public access and a write/admin share for collaborators).**Step 1: Authenticate with a read-only link share****Step 2: List all link shares for the project (hash disclosure)****Step 3: Escalate to admin using the leaked hash****Step 4: Exercise admin privileges**Impact**Permission escalation:** An attacker with any link share URL (including read-only) can escalate to the highest permission level of any other link share on the same project**Credential disclosure:** All link share hashes for a project are exposed, which are effectively bearer tokens**No account required:** Link shares are designed for unauthenticated access — the attacker only needs a link share URL that was shared publicly or forwarded to them**Common scenario:** Projects with both read-only (public) and write/admin (collaborator) link shares are the standard use case for tiered sharing**Password-protected shares:** Even password-protected share hashes are leaked, though exploitation requires knowing/brute-forcing the passwordRecommended FixAdd a link share user check at the beginning of `LinkSharing.ReadAll()`, mirroring the check in `CanRead()`:Alternatively, as a defense-in-depth measure, exclude the `Hash` field from JSON serialization for list responses by using `json:"-"` and only returning it on creation. However, the primary fix should be the authorization check since the hash is needed in the creation response.
CVSS v3.1: 7.5
CVE-2022-3810: Axiomatic Bento4 mp42hevc Mp42Hevc.cpp AP4_File denial of service
A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212667.
CVSS v3.1: 4.3
CVE-2020-7563: A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.
CVSS v3.1: 6.3
CVSS v2.0: 6.5
CVE-2004-2745: Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVSS v2.0: 7.8
CVE-2015-7057: otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7049.
CVSS v2.0: 4.6
CVE-2018-16253: In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-p9p6-vjx9-7v9f: dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
GHSA-cmv3-c9g2-j3g5: Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_static_ip parameter in the ipv6_tunnel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1: 5.7
GHSA-pq76-cc8r-h3cm: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS v3.1: 4.3
CVE-2018-9498: In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78354855
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2024-36212: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-75f2-6p94-94mp: LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
GHSA-hj32-4j4q-x3j7: admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
CVSS v3.0: 8.8
GHSA-396v-898v-98hg: When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
CVSS v3.1: 7.4
GHSA-98vv-hgmp-w5h7: Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
CVSS v3.1: 9.8
GHSA-5p8h-xw8m-3w4j: The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
CVSS v3.1: 9.8
GHSA-6292-ff8f-c4mf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Massimo Serpilli Incredible Font Awesome allows Stored XSS.This issue affects Incredible Font Awesome: from n/a through 1.0.
CVSS v3.1: 6.5
GHSA-7gjr-q697-2f77: The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash.
GHSA-5jv6-qv6x-6m4f: Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
RHSA-2019:3345: Red Hat Security Advisory: virt:rhel security, bug fix, and enhancement update
ntfs-3g: heap-based buffer overflow leads to local root privilege escalation QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables QEMU: qxl: null pointer dereference while releasing spice resources
CVSS v3.0: 3.8
GHSA-v9wj-35hg-7vg8: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
CVSS v3.1: 9.8
GHSA-h2r2-3pcg-323x: Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.
CVSS v3.0: 7.2
GHSA-c2wp-rx8j-v5r4: IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123778.
CVSS v3.0: 5.4
GHSA-w4qg-rh8m-6c8q: In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: fix NULL deref in mesh_matches_local()mesh_matches_local() unconditionally dereferences ie->mesh_config to
compare mesh configuration parameters. When called from
mesh_rx_csa_frame(), the parsed action-frame elements may not contain a
Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a
kernel NULL pointer dereference.The other two callers are already safe:ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before
calling mesh_matches_local()mesh_plink_get_event() is only reached through
mesh_process_plink_frame(), which checks !elems->mesh_config, toomesh_rx_csa_frame() is the only caller that passes raw parsed elements
to mesh_matches_local() without guarding mesh_config. An adjacent
attacker can exploit this by sending a crafted CSA action frame that
includes a valid Mesh ID IE but omits the Mesh Configuration IE,
crashing the kernel.The captured crash log:Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: events_unbound cfg80211_wiphy_work
[...]
Call Trace:
 <TASK>
 ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65)
 ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686)
 [...]
 ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802)
 [...]
 cfg80211_wiphy_work (net/wireless/core.c:426)
 process_one_work (net/kernel/workqueue.c:3280)
 ? assign_work (net/kernel/workqueue.c:1219)
 worker_thread (net/kernel/workqueue.c:3352)
 ? __pfx_worker_thread (net/kernel/workqueue.c:3385)
 kthread (net/kernel/kthread.c:436)
 [...]
 ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255)
 </TASK>This patch adds a NULL check for ie->mesh_config at the top of
mesh_matches_local() to return false early when the Mesh Configuration
IE is absent.
CVSS v3.1: 5.5
CVE-2005-4058: SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.
CVSS v2.0: 7.5
GHSA-92j2-m5rq-6p7m: An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS v3.1: 7.2
GHSA-2jrp-2x8m-mgrv: Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions.
CVE-2018-20927: cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).
CVSS v3.0: 3.8
CVSS v2.0: 2.1
GHSA-9fpp-56h8-w47g: Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot).  Supported versions that are affected are 5.1.0.0.0, 6.1.0.0.0 and  7.0.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Revenue Management and Billing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Financial Services Revenue Management and Billing. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L).
CVSS v3.1: 6
CVE-2014-7430: The Flood-It (aka com.appspot.eoltek.flood) application 4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2008-4636: yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
CVSS v2.0: 7.2
CVE-2024-11356: Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVSS v3.1: 6.1
CVE-2022-35222: HiCOS Citizen verification component - Stack Buffer Overflow
HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
CVSS v3.1: 6.8
CVE-2008-3547: Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients."
CVSS v2.0: 9
RHSA-2023:1067: Red Hat Security Advisory: pesign security update
pesign: Local privilege escalation on pesign systemd service
CVSS v3.1: 7.8
CVE-2021-33356: Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command execution with root privileges.
CVSS v3.1: 8.8
CVSS v2.0: 9
CVE-2020-6567: Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2021-46942: io_uring: fix shared sqpoll cancellation hangs
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix shared sqpoll cancellation hangs

[  736.982891] INFO: task iou-sqp-4294:4295 blocked for more than 122 seconds.
[  736.982897] Call Trace:
[  736.982901]  schedule+0x68/0xe0
[  736.982903]  io_uring_cancel_sqpoll+0xdb/0x110
[  736.982908]  io_sqpoll_cancel_cb+0x24/0x30
[  736.982911]  io_run_task_work_head+0x28/0x50
[  736.982913]  io_sq_thread+0x4e3/0x720

We call io_uring_cancel_sqpoll() one by one for each ctx either in
sq_thread() itself or via task works, and it's intended to cancel all
requests of a specified context. However the function uses per-task
counters to track the number of inflight requests, so it counts more
requests than available via currect io_uring ctx and goes to sleep for
them to appear (e.g. from IRQ), that will never happen.

Cancel a bit more than before, i.e. all ctxs that share sqpoll
and continue to use shared counters. Don't forget that we should not
remove ctx from the list before running that task_work sqpoll-cancel,
otherwise the function wouldn't be able to find the context and will
hang.
CVSS v3.1: 5.5
GHSA-94pr-jvgr-6h8f: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
CVSS v3.0: 5.3
GHSA-39pf-g98p-m3gj: Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
RHSA-2026:5133: Red Hat Security Advisory: OpenShift Container Platform 4.18.36 bug fix and security update
cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption keystonemiddleware: OpenStack keystonemiddleware: Privilege escalation and user impersonation via forged authentication headers
CVSS v3.1: 9.9
PYSEC-2022-213: An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
GHSA-vcf9-g536-773c: Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.
CVSS v3.1: 4.9
GHSA-866h-762v-8qww: The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access.
CVSS v3.1: 9.8
CVE-2020-29448: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-xx7h-hp2m-8474: IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139589.
CVSS v3.0: 5.4
PYSEC-2014-81: httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2022-30651: Adobe InCopy Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.0: 7.8
GHSA-9j63-6xgg-vpx7: Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
CVSS v3.1: 6.1
CVE-2022-0662: Adrotate < 5.8.23 - Admin+ XSS via Advert Name
The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-pmw5-hrgv-734j: Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page.
CVE-2022-21871: Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
CVSS v3.1: 7
CVE-2015-2654: Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
CVSS v2.0: 6.9
CVE-2020-37202: NetworkSleuth 3.0.0.0 - 'Key' Denial of Service
NetworkSleuth 3.0.0.0 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to trigger an application crash.
CVSS v4.0: 4.6
CVSS v3.1: 7.5
CVE-2025-15340: Tanium addressed an incorrect default permissions vulnerability in Comply.
Tanium addressed an incorrect default permissions vulnerability in Comply.
CVSS v3.1: 6.5
CVE-2016-1000229: swagger-ui has XSS in key names
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2025-21338: GDI+ Remote Code Execution Vulnerability
GDI+ Remote Code Execution Vulnerability
CVSS v3.1: 7.8
GHSA-2wg5-pqfg-hvj9: Microsoft Outlook for iOS Information Disclosure Vulnerability
CVSS v3.1: 6.5
GHSA-mpfr-rcqq-m4pw: Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
CVSS v3.1: 6.1
GHSA-mm98-4g96-h7h2: An issue in Geovision GV-ASWeb with version 6.1.0.0 or less allows unauthorized attackers with low-level privileges to be able to request information about other accounts via a crafted HTTP request.
CVSS v3.1: 6.5
GHSA-562w-w6qf-mvxf: A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. 
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 7
CVSS v3.1: 7.3
GHSA-973m-857j-grqw: The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
CVSS v3.0: 7.7