ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-29xp-372q-xqph: node-tar has a race condition leading to uninitialized memory exposure
SummaryUsing `.t` (aka `.list`) with `{ sync: true }` to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.DetailsSee:https://github.com/isaacs/node-tar/issues/445https://github.com/isaacs/node-tar/pull/446Regression happened in https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224dPoCA:B (vulnerable):Run A and B in parallel on Node.js 22 or >=25.1.0Dumps `B` memory (wait for some time to observe text data)ImpactExposes process memory and could result in e.g. unintentionally (aka attacker-controlled) attempting to process sensitive data rather than tar entry contents. Uninitialized memory can contain unrelated file contents, environment variables, passwords, etc.To execute, an attacker must reduce the file size to boundary between a tar header and body block, in the time between when the tar archive file size is read via `stat`, and the time when the tar archive parser reaches the entry that is truncated. If the file is truncated at a different boundary, then the uninitialized data will very likely not be a valid tar entry, causing the parser to treat the entry as a damaged archive (that is, throwing an error in `strict: true` mode, or by default, skipping the entry harmlessly).This is conditional on using the `sync: true` option to the `tar.list`/`tar.t` method, and the `7.5.1` version specifically. Earlier versions were not affected.This is also conditional to attacker being able to truncate (or induce a truncation/replacement) of a file on disk (e.g. in cache).If the tar file is initially larger than the `opt.maxReadSize` (16kb by default), then uninitialized memory is not exposed to user code, and instead the program enters an infinite loop, causing a DoS rather than an information disclosure vulnerability.By default, `tar.list` does _not_ process tar archive entry body content. So, this is further conditional on the user code doing something with the tar entry file contents in an `onReadEntry` method which would expose the file contents (for example, attempting to parse them in such a way that the uninitialized data could appear in an error message).Other methods in this library (`tar.extract`, etc.) are not affected by this vulnerability.
CVSS v4.0: 6.1
GHSA-c4v5-wm3r-8vq4: The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.
CVSS v3.1: 5.3
GHSA-r679-j32w-7hh4: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0: 6.5
GHSA-4x9c-j993-gcjj: Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c.
CVSS v3.1: 9.8
GHSA-w2fr-8h6p-j4jg: NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.
GHSA-p4xx-95p7-3998: An Arbitrary Free (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d.
CVSS v3.1: 9.8
CVE-2024-12968: code-projects Job Recruitment _all_edits.php edit_jobpost sql injection
A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. Affected by this vulnerability is the function edit_jobpost of the file /_parse/_all_edits.php. The manipulation of the argument jobtype leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2020-12621: The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component.
CVSS v3.1: 6.1
CVSS v2.0: 3.6
GHSA-m8w5-v3r7-7546: In the Linux kernel, the following vulnerability has been resolved:bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()If ulp = kzalloc() fails, the allocated edev will leak because it is
not properly assigned and the cleanup path will not be able to free it.
Fix it by assigning it properly immediately after allocation.
CVSS v3.1: 5.5
CVE-2010-1938: Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd.
CVSS v2.0: 9.3
GHSA-q4fv-c7v5-mh5w: Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote authenticated users to affect integrity via unknown vectors related to DM Others.
GHSA-4cvf-ff56-8rr3: A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.
CVSS v3.1: 9.8
CVE-2004-1763: Buffer overflow in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name.
CVSS v2.0: 10
CVE-2018-1000868: WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-5hv2-265f-8mm9: The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.
CVSS v3.1: 9.8
GHSA-wr95-h8f6-c4gf: IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a packet with an 0x11 value in a certain "type" field.
GHSA-6gff-w82c-xw8j: NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
CVE-2023-4237: Platform: ec2_key module prints out the private key directly to the standard output
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
CVSS v3.1: 7.3
GHSA-988g-r4v6-j68v: Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
CVE-2017-6997: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
RHSA-2021:3336: Red Hat Security Advisory: sssd security and bug fix update
sssd: shell command injection in sssctl
CVSS v3.1: 6.7
GHSA-gpmp-xp4x-88w7: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.
CVSS v3.0: 6.7
CVE-2008-6180: SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows remote attackers to execute arbitrary SQL commands via the nlb3 cookie.
CVSS v2.0: 7.5
CVE-2019-1159: Windows Kernel Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
CVSS v3.1: 7.8
GHSA-vm5h-5x2v-9vqw: Windows Defender Credential Guard Security Feature Bypass Vulnerability.
CVSS v3.1: 6
CVE-2019-2073: In libxaac there is a possible out of bounds write to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117100484
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-p9qm-p942-q3w5: XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
ImpactIt's possible to execute any SQL query in Oracle by using the function like [DBMS_XMLGEN or DBMS_XMLQUERY](https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/DBMS_XMLGEN.html).The XWiki#searchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query (for example in the WHERE).PatchesThis has been patched in 16.10.6 and 17.3.0-rc-1.WorkaroundsThere is no known workaround, other than upgrading XWiki.Referenceshttps://jira.xwiki.org/browse/XWIKI-22728For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)Email us at [Security Mailing List](mailto:security@xwiki.org)
CVSS v4.0: 8.6
GHSA-97fh-7m8x-9fcg: In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads.
CVSS v3.0: 6.5
GHSA-w7fq-695f-9q8v: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
CVSS v3.1: 6.5
GHSA-7jr4-mg5p-52mh: Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code.
CVSS v3.1: 3.3
CVE-2014-9930: In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-7rjh-8h85-p8v6: Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the delete parameter.
RHSA-2026:11688: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.15
net/url: Incorrect parsing of IPv6 host literals in net/url golang: cmd/compile: possible memory corruption after bound check elimination golang: cmd/compile: no-op interface conversion bypasses overlap checking crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
CVSS v3.1: 7.5
GHSA-7qcc-qfv9-f87g: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
GHSA-p36q-wj5r-mf9c: Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Function Security.
CVSS v3.0: 8.2
GHSA-69f2-6mjq-5xcx: A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2024-57925: ksmbd: fix a missing return value check bug
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix a missing return value check bug

In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct()
fails to allocate a node, it returns a NULL pointer to the
in_work pointer. This can lead to an illegal memory write of
in_work->response_buf when allocate_interim_rsp_buf() attempts
to perform a kzalloc() on it.

To address this issue, incorporating a check for the return
value of ksmbd_alloc_work_struct() ensures that the function
returns immediately upon allocation failure, thereby preventing
the aforementioned illegal memory access.
CVSS v3.1: 7.1
CVE-2004-1217: Hosting Controller 6.1 Hotfix 1.4, and possibly other versions, allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter to (1) Statsbrowse.asp or (2) Generalbrowse.asp.
CVSS v2.0: 5
CVE-2014-0948: Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.
CVSS v2.0: 6
CVE-2022-32824: The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose kernel memory.
CVSS v3.1: 5.5
GHSA-jg74-g2r7-p8mf: Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
GHSA-f675-2h8m-hfrq: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
GHSA-54qf-27xf-pgjq: The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
CVSS v3.1: 5.3
GHSA-fwrj-26j6-j6px: eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allow local users to gain privileges by pressing CTRL-SHIFT-ALT-DEL and entering the "maertsJ" password, which is hard-coded into lshell.
CVE-2026-40414: Windows TCP/IP Denial of Service Vulnerability
Windows TCP/IP Denial of Service Vulnerability
CVSS v3.1: 7.4
CVE-2006-5775: Cross-site scripting (XSS) vulnerability in profile.php in FunkBoard 0.71 before 4 November 2006 at 18:16 GMT allows remote attackers to inject arbitrary web script or HTML, possibly via the name parameter.
CVSS v2.0: 6.8
CVE-2021-33718: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7), Mendix Applications using Mendix 9 (All versions < V9.3.0). Write access checks of attributes of an object could be bypassed, if user has a write permissions to the first attribute of this object.
CVSS v3.1: 5.3
CVSS v2.0: 3.5
CVE-2018-6446: A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-25028: An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-mjg7-qj65-r2pp: Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file.  NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
RHBA-2023:3052: Red Hat Bug Fix Advisory: cifs-utils bug fix and enhancement update
cifs-utils: stack-based buffer overflow mount.cifs may lead to local privilege escalation to root
CVSS v3.1: 7
GHSA-qf4m-p7c4-p4m7: A vulnerability in 
SenseLiveX3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive configuration functions.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-xhw5-6m93-pmpj: An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.
GHSA-chx2-38r8-vmph: The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.
CVSS v3.1: 5.4
GHSA-2wmg-q3rm-p93r: NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an  unchecked return value to a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
CVSS v3.1: 5.5
GHSA-h77g-c8p9-3f4c: The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-screen - ensuring only those who can view it are streaming.In addition to the password, each projector has a hardcoded "backdoor" code (2270), which authenticates to all devices.
CVSS v3.0: 9.8
CVE-2020-16990: Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
CVSS v3.1: 6.2
CVE-2007-2745: Cross-site scripting (XSS) vulnerability in printcal.pl in vDesk Webmail 4.03 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
CVSS v2.0: 4.3
CVE-2024-0377: LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it possible for unauthenticated attackers to publish an unrestricted number of reviews on the site.
CVSS v3.1: 5.3
CVE-2006-1741: Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".
CVSS v2.0: 4.3
GHSA-vfq5-mm65-6p52: Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs and perform other administrative tasks via unspecified vectors, possibly related to delete_*.aspx pages, and massedit.aspx, subscribe.aspx, flag.aspx, and relationships.aspx.
RHSA-2026:21682: Red Hat Security Advisory: python3.9 security update
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVSS v3.1: 8.1
CVE-2014-4496: The mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
CVSS v2.0: 5
CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
CVSS v3.0: 4.8
CVSS v2.0: 5.8
CVE-2021-28675: An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-xhjh-m9vh-w983: Directory traversal vulnerability in the web server in SpecView 2.5 build 853 and earlier allows remote attackers to read arbitrary files via a ... (dot dot dot) in a URI.
CVE-2025-35965: DoS in Mattermost Playbooks via Excessive Task Actions
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
CVSS v3.1: 6.5
GHSA-2mcr-hvvf-8r3g: The IP-in-IP packet processing implementation in the IPsec and IP stacks in the kernel in Sun Solaris 9 and 10, and OpenSolaris snv_01 though snv_85, allows local users to cause a denial of service (panic) via a self-encapsulated packet that lacks IPsec protection.
CVE-2017-2641: In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-x5rv-rq98-7w2m: The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2021-21736: A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E
CVSS v3.1: 7.2
CVSS v2.0: 8
GHSA-rrgm-366h-c73x: The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
CVSS v3.1: 9.8