ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-9246: Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24135.
CVSS v3.0: 3.3
GHSA-jmvc-hx3f-5mj7: KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
CVSS v3.1: 5.3
GHSA-m67q-f4jm-62rg: A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php.
CVSS v3.0: 6.1
GHSA-xp39-whpp-93gx: An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16938.
CVSS v3.1: 5
GHSA-vm58-hv8h-jghp: Cross-site scripting (XSS) vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session.
RHSA-2024:9576: Red Hat Security Advisory: libsoup security update
libsoup: HTTP request smuggling via stripping null bytes from the ends of header names
CVSS v3.1: 7.5
CVE-2009-3492: Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in lib/Loggix/Module/; and (5) modules/downloads/lib/LM_Downloads.php.
CVSS v2.0: 7.5
GHSA-rwqw-xg7v-p5r6: Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v3.0: 7.8
GHSA-q825-wqg2-gxm8: In the Linux kernel, the following vulnerability has been resolved:regmap: Fix race condition in hwspinlock irqsave routinePreviously, the address of the shared member '&map->spinlock_flags' was
passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race
condition where multiple contexts contending for the lock could overwrite
the shared flags variable, potentially corrupting the state for the
current lock owner.Fix this by using a local stack variable 'flags' to store the IRQ state
temporarily.
CVSS v3.1: 4.7
CVE-2017-18900: An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-4mmc-mh89-xjx6: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
CVSS v3.1: 6.5
GHSA-3pmw-j7vc-7gww: Internet Explorer 5.0 allows window spoofing, allowing a remote attacker to spoof a legitimate web site and capture information from the client.
GHSA-jmj7-mv84-mqc2: OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.
GHSA-994r-w2xc-hgf2: The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2025-40887: Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
CVSS v4.0: 6
CVSS v3.1: 5.3
ICSA-24-172-02: CAREL Boss-Mini
Under certain conditions, a malicious actor already present in the same network segment of the affected product, could abuse Local File Inclusion (LFI) techniques to access unauthorized file system resources, such as configuration files, password files, system logs, or other sensitive data. This could expose confidential information and potentially lead to further threats.
CVSS v3.1: 9.8
CVE-2023-41312: Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.
CVSS v3.1: 5.3
CVE-2026-11283: Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
CVSS v3.1: 6.5
GHSA-hgqx-r2hp-jr38: TinyMCE XSS vulnerability in notificationManager.open API
ImpactA [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling.  The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered.When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when an notification presented in the TinyMCE UI for the current user.  This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content.PatchesThis vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit.FixTo avoid this vulnerability:Upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x.Upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.References<https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes><https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes>For more informationIf you have any questions or comments about this advisory:Email us at <infosec@tiny.cloud>Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)
CVSS v3.1: 6.1
GHSA-4qxg-56mj-c47p: Microsoft Office Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24108, CVE-2021-27057.
CVSS v3.1: 7.6
GHSA-92wv-q3g7-82cp: Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able to communicate through NATR as a result of denial-of-service or NAT rule modifications. NAT rule modification could also result in device communication to incorrect endpoints. Admin account takeover could allow modification of configuration and require physical access to restore.
CVSS v4.0: 9.9
CVSS v3.1: 9.8
GHSA-5m4f-q4wf-8492: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox allows Cross-Site Scripting (XSS).This issue affects SambaBox: before 5.1.
CVSS v3.1: 4
GHSA-hg47-m38x-5m72: The â€œElementor Addons â€“ PowerPack Addons for Elementorâ€? WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
GHSA-32cw-4h2j-22vc: Buffer overflow in the SMB capability for Microsoft Windows XP, 2000, and NT allows remote attackers to cause a denial of service and possibly execute arbitrary code via an SMB packet that specifies a smaller buffer length than is required.
CVE-2020-1440: Microsoft SharePoint Server Tampering Vulnerability
<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p>
<p>To exploit the vulnerability, an attacker would need to be authenticated on an affected SharePoint Server. The attacker would then need to send a specially modified request to the server, targeting a specific user.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft SharePoint Server handles profile data.</p>
CVSS v3.1: 6.3
GHSA-f59c-7r8p-q47f: Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider in SDMHS.
CVSS v3.1: 4
GHSA-4xq4-ppq9-6vrh: Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S firmware v1.05 and earlier, WRH-300WH3-S firmware v1.05 and earlier, and WRH-300YG3-S firmware v1.05 and earlier) allows an attacker on the adjacent network to execute an arbitrary OS command via unspecified vectors.
CVSS v3.1: 8.8
GHSA-qjq7-2mhq-r456: A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.
CVSS v3.1: 7.5
GHSA-g743-m6x3-v6wm: An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1: 7.5
GHSA-x5xw-28w4-53j5: imaginAIry Denial of Service (DoS) vulnerability
A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in the `/api/stablestudio/generate` endpoint, which can be exploited by sending an invalid request. This causes the server process to terminate abruptly, outputting `KILLED` in the terminal, and results in the unavailability of the server. This issue disrupts the server's functionality, affecting all users.
CVSS v3.0: 7.5
GHSA-2hcp-gjrf-7fhc: Micronaut Framework vulnerable to a Denial of Service in HTML error response caching
`DefaultHtmlErrorResponseBodyProvider` in `io.micronaut:micronaut-http-server` since `4.7.0` and until `4.10.7` used an unbounded `ConcurrentHashMap` cache with no eviction policy. If the application throws an exception whose message may be influenced by an attacker, for example, including request query value parameters,  this could be used by remote attackers
to cause a denial of service (unbounded heap growth and OutOfMemoryError).Fixed via: https://github.com/micronaut-projects/micronaut-core/commit/1e2ba2c14386af3d47751732d02053a72b0b49b3
CVSS v3.1: 7.5
GHSA-cxr8-p3g6-983f: On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.
CVSS v3.0: 9.1
GHSA-rv8w-h7cq-9wg2: Buffer overflow in the utape program in devices.scsi.tape.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
CVE-2008-0989: Format string vulnerability in mDNSResponderHelper in Apple Mac OS X 10.5.2 allows local users to execute arbitrary code via format string specifiers in the local hostname.
CVSS v2.0: 6.9
GHSA-cf6r-3wgc-h863: Polymorphic deserialization of malicious object in jackson-databind
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVSS v3.0: 7.5
CVE-2019-9552: Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-h773-7gf7-9m2x: NeuVector is shipping cryptographic material into its binary
ImpactNeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations  when NeuVector stores the data.In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.If the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : `Required Kubernetes RBAC for secrets are not found` and exits.The device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.PatchesPatched versions include release **v5.4.7** and above.WorkaroundsThere is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.ReferencesIf you have any questions or comments about this advisory:Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
CVSS v3.1: 6.5
GHSA-mxr5-mc97-63rc: Account Takeover in Octobercms
ImpactAn attacker can request an account password reset and then gain access to the account using a specially crafted request.To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form.PatchesIssue has been patched in Build 472 and v1.1.5[Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)WorkaroundsApply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.RecommendationsWe recommend the following steps to make sure your server stays secure:Keep server OS and system software up to date.Keep October CMS software up to date.Use a multi-factor authentication plugin.Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.ReferencesBugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim TeplykhFor more informationIf you have any questions or comments about this advisory:Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
CVSS v3.1: 8.2
GHSA-438j-8gh2-h5w4: The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1: 5.4
CVE-2018-0566: Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2007-2443: Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.
CVSS v2.0: 8.3
GHSA-8jrf-cjx8-q3g8: Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the multiple parameter in the image cropping function.
CVSS v3.1: 5.4
CVE-2021-34354: Stored Cross-site Scripting Vulnerability in Photo Station
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later
CVSS v3.1: 7.6
CVE-2009-2746: Cross-site request forgery (CSRF) vulnerability in the administrative console in the Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS v2.0: 6.8
GHSA-fqqj-5wmx-j7xv: The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2448.
GHSA-9mhv-xfmw-mcmq: Ericsson
Indoor Connect 8855 contains a vulnerability where server-side security can be
bypassed in the client which if exploited can lead to unauthorized disclosure
of user accounts.
CVSS v4.0: 5.1
CVSS v3.1: 7.5
CVE-2024-26086: Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
CVE-2024-27880: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, tvOS 18, visionOS 2, watchOS 11. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS v3.1: 5.5
RHSA-2025:13100: Red Hat Security Advisory: python-cryptography security update
python-cryptography: NULL-dereference when loading PKCS7 certificates
CVSS v3.1: 7.5
CVE-2023-21886: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 6.1.42 and  prior to 7.0.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 8.1
CVE-2020-26112: The email quota cache in cPanel before 90.0.10 allows overwriting of files.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-37158: Evmos is missing precompile checks
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions and one for Ethereum transactions. Checks performed on the two implementation are different. The vulnerability discovered allowed a clawback account to bypass Cosmos ante handler checks by sending an Ethereum transaction targeting a precompile used to interact with a Cosmos SDK module. This vulnerability is fixed in 18.0.0.


CVSS v3.1: 3.5
RHSA-2021:3443: Red Hat Security Advisory: kpatch-patch security update
kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c kernel: use-after-free in route4_change() in net/sched/cls_route.c kernel: powerpc: KVM guest OS users can cause host OS memory corruption
CVSS v3.1: 7.8
CVE-2021-25054: WPcalc <= 2.1 - Authenticated SQL Injection
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-f82v-mcfc-hrmc: Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
GHSA-6ff6-9x49-rq55: A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.25.46 or later to resolve this issue.
CVE-2011-4947: Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the user_include parameter.
CVSS v2.0: 6.8
CVE-2022-1977: WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
CVSS v3.1: 7.2
CVSS v2.0: 6
CVE-2008-2479: Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) kind parameter to fix/browse.php and the (2) account parameter to auth/00_pass.php.
CVSS v2.0: 6.8
CVE-2024-8715: Simple LDAP Login <= 1.6.0 - Reflected Cross-Site Scripting
The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-6p79-qp56-xj76: The SMB client implementation in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate response fields, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted response, aka "SMB Client Pool Corruption Vulnerability."
GHSA-v3q8-hfj4-rq9j: A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input.
CVSS v3.1: 9.8