ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-26809: netfilter: nft_set_pipapo: release elements in clone only from destroy path
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: release elements in clone only from destroy path

Clone already always provides a current view of the lookup table, use it
to destroy the set, otherwise it is possible to destroy elements twice.

This fix requires:

 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")

which came after:

 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").
CVSS v3.1: 5.5
RHSA-2021:0258: Red Hat Security Advisory: cryptsetup security update
cryptsetup: Out-of-bounds write when validating segments
CVSS v3.1: 7.8
CVE-2023-29053: A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1: 7.8
GHSA-2cjm-2gwv-m892: Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
ImpactParse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute using another provider's configuration, potentially allowing a token that should be rejected by one provider to be accepted because it is validated against a different provider's policy.Deployments that configure multiple OAuth2 providers via the `oauth2: true` flag are affected.PatchesThe fix ensures that a new adapter instance is created for each provider instead of reusing the singleton, so each provider's configuration is isolated.WorkaroundsThere is no known workaround. If only a single OAuth2 provider is configured, the race condition cannot occur.ReferencesGitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2cjm-2gwv-m892Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.11Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.37
CVSS v4.0: 9.1
GHSA-p56j-x44h-g66j: Incorrect Privilege Assignment in Jenkins Script Security Plugin
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS v3.1: 8.8
CVE-2014-8950: Unspecified vulnerability in Check Point Security Gateway R77 and R77.10, when the (1) URL Filtering or (2) Identity Awareness blade is used, allows remote attackers to cause a denial of service (crash) via vectors involving an HTTPS request.
CVSS v2.0: 7.1
GHSA-m534-rvfg-879c: gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2023-4556: SourceCodester Online Graduate Tracer System sexit.php mysqli_query sql injection
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is the function mysqli_query of the file sexit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238154 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2022-35926: Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG
Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option header and the Source Link-Layer Address Option (SLLAO). This attack requires ipv6 be enabled for the network. The problem has been patched in the develop branch of Contiki-NG. The upcoming 4.8 release of Contiki-NG will include the patch.Users unable to upgrade may apply the patch in Contiki-NG PR #1654.
CVSS v3.1: 5.9
CVE-2019-17212: Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-v856-2rf8-9f28: pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
SummaryA crafted `DICOMDIR` can set `ReferencedFileID` to a path outside the File-set root. `pydicom` resolves the path only to confirm that it exists, but does not verify that the resolved path remains under the File-set root. Subsequent public `FileSet` operations such as `copy()`, `write()`, and `remove()+write(use_existing=True)` use that unchecked path in file I/O operations. This allows arbitrary file read/copy and, in some flows, move/delete outside the File-set root.DetailsVerified on `pydicom 3.1.0.dev0`.Relevant logic is in `src/pydicom/fileset.py`:`RecordNode._file_id` converts `ReferencedFileID` directly to `Path(...)``FileSet.load()` checks only `(root / file_id).resolve(strict=True)` to confirm existence`FileSet.load()` does not verify that the final resolved path is contained within the File-set root`FileInstance.path` returns `self.file_set.path / self.node._file_id``FileSet.copy()` uses `shutil.copyfile(instance.path, dst)``FileSet.write()` uses `Path(instance.path).unlink()` and `shutil.move(...)`Because there is no containment check such as `resolved.relative_to(root.resolve(strict=True))`, a malicious `DICOMDIR` can reference:absolute paths such as `/etc/passwd`traversal paths such as `../...`syntactically conformant file IDs that escape via symlinksThis is not limited to obviously invalid VR input. Even when `pydicom` emits warnings for invalid `ReferencedFileID` values, the operation is not blocked. I also confirmed a symlink-based variant using a conformant file ID.A realistic server-side scenario is:a user uploads a DICOM File-set zipthe server loads the uploaded `DICOMDIR` using `FileSet`the server re-exports or reorganizes the File-set using `FileSet.copy()` or `FileSet.write()`a server-local file referenced by the malicious `DICOMDIR` is included in the exported resultPoCMinimal reproduction:Copy a sample File-set that contains a valid `DICOMDIR`Modify one `DirectoryRecordSequence` item so that `ReferencedFileID = "/etc/passwd"` (or `/tmp/secret.txt`)Load it with `FileSet(ds)` or `FileSet(path_to_dicomdir)`Call `FileSet.copy(new_root)`Observe that the exported File-set contains the contents of the referenced external fileExample:I also verified the issue in a simple web import/export demo where an uploaded malicious File-set caused /etc/passwd to be copied into the exported result.If useful, I can provide the exact malicious sample and the demo environment separately.ImpactThis is a path traversal / root containment bypass in FileSet handling.Observed impact:arbitrary file read/copy outside the File-set root via FileSet.copy()
arbitrary file move outside the File-set root via FileSet.write()
arbitrary file delete outside the File-set root via FileSet.remove(...); write(use_existing=True)
Affected applications are those that accept untrusted DICOMDIR / File-set input and then call public FileSet workflows such as load(), copy(), write(), or remove().A realistic impact is server-side file disclosure in import/export workflows.
CVSS v3.1: 7.8
GHSA-6fgv-p835-w43w: In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
CVSS v3.1: 7.8
cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrt: Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Inter-VM Channel Command Injection Vulnerability
A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, adjacent attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device.

The vulnerability is due to insufficient validation of signaling packets that are destined to VDS. An attacker could exploit this vulnerability by sending malicious packets to an affected device. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. Because the device is designed on a hypervisor architecture, exploitation of a vulnerability that affects the inter-VM channel may lead to a complete system compromise.

For more information about this vulnerability, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrt ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrt"]


This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [" https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388"].
CVSS v3.0: 8.8
CVE-2020-7136: A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-rjmh-3x6m-hgvq: IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2024-0162: Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM.
CVSS v3.1: 5.3
GHSA-2wcm-vx67-3x4q: Duplicate Advisory: GHSA-x698-5hjm-w2m5
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-x698-5hjm-w2m5. This link is maintained to preserve external references.Original DescriptionAny unauthenticated attacker can bypass the localhost 
restrictions posed by the application and utilize this to create 
arbitrary packages
CVSS v4.0: 8.7
CVE-2010-1624: The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message.
CVSS v2.0: 5
CVE-2026-42345: FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith() check against a hardcoded list. This check can be bypassed using at least 7 different URL encoding techniques, all of which resolve to the same cloud metadata service but do not match the blocklist patterns. Additionally, the broader private IP check (isInternalIPv4/isInternalIPv6) is disabled by default because CHECK_INTERNAL_IP defaults to false (not 'true'), so these bypasses reach the metadata endpoint without any further validation. At time of publication, there are no publicly available patches.
CVSS v3.1: 7.7
GHSA-r9mq-hc5w-gx5f: Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0069.
CVSS v3.0: 8.8
GHSA-wwg2-2crq-6grr: Prototype pollution in @strikeentco/set
Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS v3.1: 7.5
GHSA-x8jx-65f6-p7vf: VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a windows host where Workstation is installed.
CVE-2022-24879: Malfunction of Cross-Site Request Forgery token validation
Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
CVSS v3.1: 7.5
CVE-2025-67231: A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
CVSS v3.1: 5.9
GHSA-w8pp-xqh8-jqw5: An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack.
CVE-2025-20251: Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File Deletion
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to create or delete arbitrary files on the underlying operating system. If critical system files are manipulated, new Remote Access SSL VPN sessions could be denied and existing sessions could be dropped, causing a denial of service (DoS) condition. An exploited device requires a manual reboot to recover.

This vulnerability is due to insufficient input validation when processing HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to create or delete files on the underlying operating system, which could cause the Remote Access SSL VPN service to become unresponsive.
To exploit this vulnerability, the attacker must be authenticated as a VPN user of the affected device.
CVSS v3.1: 8.5
GHSA-24xj-r6rg-2w25: Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.
CVSS v3.1: 9.9
GHSA-6f59-wxf3-55jc: Unspecified vulnerability in the Oracle Retail Order Broker component in Oracle Retail Applications 15.0 allows remote attackers to affect confidentiality and integrity via vectors related to System Administration.
CVSS v3.0: 5.4
CVE-2023-28843: Improper neutralization of SQL parameter in PayPal module for PrestaShop
PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
CVSS v3.1: 9.8
CVE-2025-27467: Windows Digital Media Elevation of Privilege Vulnerability
Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2024-56085: An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection.
CVSS v3.1: 5.9
GHSA-v7wr-69gh-4wh3: In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412240; Issue ID: MSV-3293.
CVSS v3.1: 5.5
CVE-2025-48544: In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-qq3j-xp49-j73f: Plugin archive directory traversal in Helm
The Helm core maintainers have identified an information disclosure
vulnerability in Helm 3.0.0-3.2.3.ImpactA traversal attack is possible when installing Helm plugins from a tar
archive over HTTP.  It is possible for a malicious plugin author to inject a relative
path into a plugin archive, and copy a file outside of the intended directory.Traversal Attacks are a form of a Directory Traversal that can be exploited by
extracting files from an archive. The premise of the Directory Traversal
vulnerability is that an attacker can gain access to parts of the file system
outside of the target folder in which they should reside. The attacker can
then overwrite executable files and either invoke them remotely or wait for
the system or user to call them, thus achieving Remote Command Execution on
the victim's machine. The vulnerability can also cause damage by overwriting
configuration files or other sensitive resources, and can be exploited on both
client (user) machines and servers.https://snyk.io/research/zip-slip-vulnerabilitySpecific Go Packages Affectedhelm.sh/helm/v3/pkg/plugin/installerPatchesThis issue has been fixed in Helm 3.2.4For more informationIf you have any questions or comments about this advisory:Open an issue in [the Helm repository](https://github.com/helm/helm/issues)For security-specific issues, email us at [cncf-helm-security@lists.cncf.io](mailto:cncf-helm-security@lists.cncf.io)
CVSS v3.1: 3.7
GHSA-fhvp-9hcj-6m33: Oxia has an OIDC token audience validation bypass via SkipClientIDCheck
SummaryThe OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.ImpactIn deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.All versions using OIDC authentication are affected.DetailsIn `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check — which validates the `aud` claim against the expected `client_id` — is completely bypassed.PatchesFixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.WorkaroundsEnsure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.
CVSS v4.0: 9.3
GHSA-f55p-m2v7-m3pw: WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.
CVSS v3.0: 6.5
CVE-2023-54015: net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device

In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.
RHSA-2020:1604: Red Hat Security Advisory: tcpdump security update
tcpdump: Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap
CVSS v3.0: 4.3
GHSA-478p-wq8m-rrr4: TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during service startup or system reboot with LocalSystem privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2022-36182: Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
CVSS v3.1: 6.1
GHSA-77jf-5mcg-g6m9: A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
CVSS v3.1: 9.8
GHSA-gf96-mx62-w378: Visual Studio Code Spoofing Vulnerability
CVSS v3.1: 5.5