ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gxqj-2fg2-r9jh: A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of the component Media Upload Page. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268824. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2017-18845: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38 and R6800 before 1.1.0.38.
CVSS v3.0: 8.4
CVE-2024-0885: SpyCamLizard HTTP GET Request denial of service
A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252036.
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-22q2-gf4f-hvw6: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session.
CVSS v4.0: 5.8
CVE-2024-22225: 

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.


CVSS v3.1: 7.8
CVE-2008-0713: Unspecified vulnerability in the FTP server for HP-UX B.11.11, B.11.23, and B.11.31 allows remote authenticated users to cause a denial of service (FTP server outage) via unknown attack vectors.
CVSS v2.0: 6.8
GHSA-v34h-7f4q-76h6: An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted requests.
CVSS v3.1: 7.5
CVE-2024-52294: khoj has an IDOR in subscription management that allows unauthorized subscription modifications
Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. The issue was fixed in version 1.29.10. Support for arbitrarily presenting an email for update has been deprecated.
CVSS v3.1: 4.3
CVE-2024-2941: Campcodes Online Examination System loginExe.php sql injection
A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /adminpanel/admin/query/loginExe.php. The manipulation of the argument pass leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258032.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-xx3r-74m7-rjg4: In the Linux kernel, the following vulnerability has been resolved:md/dm-raid: don't call md_reap_sync_thread() directlyCurrently md_reap_sync_thread() is called from raid_message() directly
without holding 'reconfig_mutex', this is definitely unsafe because
md_reap_sync_thread() can change many fields that is protected by
'reconfig_mutex'.However, hold 'reconfig_mutex' here is still problematic because this
will cause deadlock, for example, commit 130443d60b1b ("md: refactor
idle/frozen_sync_thread() to fix deadlock").Fix this problem by using stop_sync_thread() to unregister sync_thread,
like md/raid did.
CVSS v3.1: 5.5
GHSA-m4f8-h2j6-g2c3: A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.
CVSS v3.1: 7.5
GHSA-xpx7-hxr3-j5f5: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVSS v3.0: 7.5
GHSA-4g73-w726-53h3: OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
CVSS v3.1: 4.3
GHSA-r7p6-97wr-9mrg: Cross-site scripting (XSS) vulnerability in index.php in Sympoll 1.5 allows remote attackers to inject arbitrary web script or HTML via the vo parameter.
CVE-2024-49256: WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability
Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.
CVSS v3.1: 6.5
CVE-2021-32935: Cognex In-Sight OPC Server - Deserialization of Untrusted Data
The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.
CVSS v3.1: 8.8
CVE-2005-4824: PHP remote file inclusion vulnerability in web/classes.php in Siteframe before 3.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the LOCAL_PATH parameter, a different vulnerability than CVE-2005-1965.
CVSS v2.0: 7.5
CVE-2022-31238: Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulnerability. A CLI user may potentially exploit this vulnerability, leading to information disclosure.
CVSS v3.1: 4.7
CVE-2012-6097: File descriptor leak in cronie 1.4.8, when running in certain environments, might allow local users to read restricted files, as demonstrated by reading /etc/crontab.
CVSS v2.0: 4.3
GHSA-3prv-vwp2-jh9f: Information disclosure due to buffer overread in Core
CVSS v3.1: 5.5
RHSA-2006:0486: Red Hat Security Advisory: mailman security update
security flaw
CVE-2019-12812: MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2024-9809: SourceCodester Online Eyewear Shop Master.php delete_product sql injection
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_product of the file /classes/Master.php?f=delete_product. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVSS v3.1: 7.5
GHSA-892r-x96w-jh76: A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.
CVSS v3.1: 7.3
CVE-2025-21591: Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crash
A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition.

Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition.


This issue affects Junos OS:



  *  from 23.1 before 23.2R2-S3,
  *  from 23.4 before 23.4R2-S3,
  *  from 24.2 before 24.2R2.


This issue isn't applicable to any versions of Junos OS before 23.1R1. 



This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. 

This issue doesn't affect Junos OS Evolved.

There are no indicators of compromise for this issue.
CVSS v4.0: 7.1
CVSS v3.1: 7.4
RHBA-2023:0773: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.28 packages update
haproxy: segfault DoS
CVSS v3.1: 4.3
GHSA-2j3g-9pf6-phh4: Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are 
vulnerable to heap-based buffer overflow, which could allow an attacker 
to execute arbitrary code.
CVSS v3.1: 7.8
GHSA-qxc6-8p8j-4r52: passwdehd in libpam-mount 0.43 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/passwdehd.##### temporary file.
GHSA-6qcg-g8hp-m564: The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.
CVE-2007-1816: SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS v2.0: 7.5
CVE-2024-0857: SQLi in Universal Software's FlexWater Corporate Water Management
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection.

This issue affects FlexWater Corporate Water Management: before 5.452.0.
CVSS v3.1: 9.8
GHSA-p357-vv6x-p853: initscripts in Red Hat Enterprise Linux 4 does not properly handle certain environment variables when /sbin/service is executed, which allows local users with sudo permissions for /sbin/service to gain root privileges via unknown vectors.
GHSA-7q98-jqhp-cqvg: The mint function of a smart contract implementation for Unolabo (UNLB), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVE-2000-0930: Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch.
CVSS v2.0: 5
CVE-2016-15024: doomsider shadow denial of service
A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.
CVSS v3.1: 2.5
CVSS v3.0: 2.5
CVSS v2.0: 1
RHSA-2013:1286: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 3
Console: Stored cross-site scripting (XSS)
CVE-2026-0396: HTML injection in the web dashboard
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
CVSS v3.1: 3.1
RHSA-2026:25198: Red Hat Security Advisory: libsndfile security update
libsndfile: integer overflow in ima_reader_init()
CVSS v3.1: 8.2
CVE-2017-13095: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of a license-deny response to a license grant
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of a license-deny response to a license grant. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2022-21498: Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.1: 6.5
GHSA-q53v-392r-55mw: A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6. An app may be able to read arbitrary files.
CVSS v3.1: 5.5
GHSA-m5q5-hmc4-cgcg: A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of the component Endpoint. Executing manipulation of the argument NatBind can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 8.9
CVSS v3.1: 9.8
GHSA-4m5r-w2rq-q54q: LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
SummaryThe application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code.DetailsUser with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name of the device Display Name, its can be trigger from different sources.PoCUse an Admin role user to change the Display Name of a device into the payload `<img src="x" onerror="alert(document.cookie)">`![image](https://github.com/user-attachments/assets/a0cce15d-fa25-46cf-a16d-648b501724a4)2.1. Go to manage user and choose Manage Access![image](https://github.com/user-attachments/assets/079bd7a7-c153-4630-a59e-416bbbaf267b)2.2. A pop-up will show![image](https://github.com/user-attachments/assets/2fe15976-c25d-4ba5-a9c1-08cfaa5c1c5b)3.1. Create a new Alert Rule where it will check if the device is up or down by using ICMP and then add the rule to the device.![image](https://github.com/user-attachments/assets/135093ba-d28c-4fe4-871d-950a2d521b01)3.2. Once the device is down, there will be an alert in the Alerts Notifications![image](https://github.com/user-attachments/assets/f32461be-aee2-43e7-ba50-977ed27754b4)3.3. Hover over the Hostname will see a pop-up.![image](https://github.com/user-attachments/assets/314eed99-1372-40e8-818f-4494679e476e)4.1. The same can be trigger in the Alert History once hover over the Device field.![image](https://github.com/user-attachments/assets/33dd2045-2c21-4305-a7a6-8c09101baf81)5.1. The same can be trigger once hover over the Hostname field from the Event Log of the device.![image](https://github.com/user-attachments/assets/a8a80dc7-4678-4334-a03a-e38d61e55e1c)6.1. The same can be trigger in the Outages function in the Logs of the device.![image](https://github.com/user-attachments/assets/b25d1c20-de6d-4c8d-bfab-59691b3faf1e)7.1. In the Active Alerts of the device.![image](https://github.com/user-attachments/assets/73571f83-56e2-4e6f-9af4-621df2a0ccdd)8.2. In the Alert History of the device.![image](https://github.com/user-attachments/assets/1fa4a86b-4469-4e09-a4d8-174529138199)9.1. They can also be trigger in the dashboard.![image](https://github.com/user-attachments/assets/0d3f3926-b41d-48d2-9212-cbd5692f6a9e)![image](https://github.com/user-attachments/assets/6f36fc02-eae5-4a46-b6ba-f99a8d1db8a8)10.1. Also if change the payload into `<img src="x" onerror="alert(document['cookie'])">`, it can also be trigger in the Availability Map.![image](https://github.com/user-attachments/assets/9ed7ebb1-4906-43f0-aa96-313fe722a533)![image](https://github.com/user-attachments/assets/d7c57840-4431-4ccb-b688-e813c83ac20c)ImpactIt could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions.
Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.
CVSS v3.1: 7.2
GHSA-r3hf-m9v3-m56g: IBM OpenPages 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points related to workflow feature of OpenPages. An authenticated user is able to obtain certain information about Workflow related configuration and internal state.
CVSS v3.1: 4.3
GHSA-g375-749q-973m: The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
CVSS v3.0: 7.5
GHSA-3xwf-x58p-42cm: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service (DoS).If a specific valid IP packet is received and that packet needs to be routed over a VXLAN tunnel, this will result in a PFE wedge condition due to which traffic gets impacted. As this is not a crash and restart scenario, this condition will persist until the system is rebooted to recover.This issue affects Juniper Networks Junos OS on QFX10000:
20.3 version 20.3R1 and later versions;
20.4 versions prior to 20.4R3-S5;
21.1 versions prior to 21.1R3-S5;
21.2 versions prior to 21.2R3-S5;
21.3 versions prior to 21.3R3-S4;
21.4 versions prior to 21.4R3-S1;
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2;
22.3 versions prior to 22.3R1-S2, 22.3R2.
CVSS v3.1: 7.5
CVE-2005-4831: viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other attacks, as demonstrated using (1) "text/html", or (2) "image/jpeg" with an image that is rendered as HTML by Internet Explorer, a different vulnerability than CVE-2004-1062.  NOTE: it was later reported that 0.9.4 is also affected.
CVSS v2.0: 4.3
CVE-2023-23464: Media CP Media Control Panel – Information Disclosure
Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.
CVSS v3.1: 8.1
CVE-2025-46485: WordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
CVSS v3.1: 5.3
CVE-2022-0142: Visual Form Builder < 3.0.6 - CSV Injection
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2023-20630: In usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628505; Issue ID: ALPS07628505.
CVSS v3.1: 6.7
GHSA-g2f3-4m96-72g7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Disclaimer Buttons allows Stored XSS. This issue affects MWW Disclaimer Buttons: from n/a through 3.41.
CVSS v3.1: 5.9
CVE-2001-0232: newsdesk.cgi in News Desk 1.2 allows remote attackers to read arbitrary files via shell metacharacters.
CVSS v2.0: 5
GHSA-pvcj-xvm2-wgmw: Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrary firmware updates, resulting in code execution.
CVSS v3.1: 8.6
CVE-2012-1817: Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file.
CVSS v2.0: 7.5
GHSA-63xv-5555-rrjh: This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS v3.1: 8.8
CVE-2011-1959: The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of service (application crash) via a large length value in a snoop file that triggers a stack-based buffer over-read.
CVSS v2.0: 4.3
GHSA-4cxw-rrj3-g8mv: In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
CVSS v3.1: 5.3
GHSA-m3g9-6hxq-c8fj: A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter.
CVSS v3.1: 6.1
GHSA-c97c-hrfm-f3wc: There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421 in JerryScript 3.0.0.
CVE-2018-6953: In CCN-lite 2, the Parser of NDNTLV does not verify whether a certain component's length field matches the actual component length, which has a resultant buffer overflow and out-of-bounds memory accesses.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2013-3743: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 45 and earlier and 5.0 Update 45 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
CVSS v2.0: 9.3
CVE-2020-6561: Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS v3.1: 6.5
CVSS v2.0: 4.3