ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-9g64-r942-fvmp: Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability
Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed.The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether.Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
CVSS v3.1: 9.8
CVE-2026-27784: NGINX ngx_http_mp4_module vulnerability
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2024-21784: Uncontrolled search path for some Intel(R) IPP Cryptography software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-w2wv-47q4-8cfp: A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
CVSS v4.0: 6
CVSS v3.1: 8.2
GHSA-c3jh-vcp9-f2mx: A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-8ghp-mgj8-vqhc: Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.
CVE-2015-5463: AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands, (2) perform a horizontal and vertical privilege escalation, (3) cause a Denial of Service on global application, or (4) write/read/delete arbitrary files on server hosting the application.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-2r9j-2jrh-5rqj: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptp_client.lua file.
CVSS v3.0: 7.2
GHSA-7p6q-wh2x-4x7c: Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the (1) UserName or (2) Password to the NAS User Setup page, (3) deviceName to USB_advanced.htm, or (4) Network Key to the Wireless Setup page.
GHSA-g929-vm5v-86gq: An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.
GHSA-fjv2-mj28-xvpf: The TCP implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.3(0), 3.3(1), 4.0(0), and 4.1(0) does not properly initiate new TCP sessions when a previous session is in a FIN wait state, which allows remote attackers to cause a denial of service (TCP outage) via vectors involving FIN packets, aka Bug ID CSCuy45136.
CVSS v3.0: 5.3
GHSA-x7p9-qfhh-r6x9: Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions.
CVSS v3.1: 8.8
CVE-2020-26122: Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism, the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2022-35164: LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.
CVSS v3.1: 9.8
CVE-2021-31970: Windows TCP/IP Driver Security Feature Bypass Vulnerability
Windows TCP/IP Driver Security Feature Bypass Vulnerability
CVSS v3.1: 5.5
GHSA-q754-vwc4-p6qj: Authenticated Stored Cross-site Scripting in Shopware
ImpactAuthenticated Stored XSS in AdministrationPatchesWe recommend updating to version 5.7.12. You can get the update to 5.7.12 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/de/changelog-sw5/#5-7-12For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.htmlReferenceshttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022
CVSS v3.1: 5.4
GHSA-xq4v-vrp9-vcf2: Cross-site Scripting vulnerability in repository issue list in Gogs
Impact`DisplayName` allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list.Patches`DisplayName` is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.WorkaroundsCheck and update the existing users' display names that contain malicious characters.ReferencesN/AFor more informationIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.
CVSS v3.1: 5.4
PYSEC-2013-39: OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
CVE-2019-13109: An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-vg6g-9h68-878w: In the Linux kernel, the following vulnerability has been resolved:fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate foliosFUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios
can contain uninitialized data.
Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already
in the page cache and not wait for data from the FUSE daemon, treat
!uptodate folios as if they weren't present.This only has security impact on systems that don't enable automatic
zero-initialization of all page allocations via
CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1.
GHSA-xq7c-hjvw-rh5f: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
CVSS v3.1: 5.3
RHSA-2026:7477: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification gnutls: Vulnerability in GnuTLS otherName SAN export gnutls: Vulnerability in GnuTLS SCT extension parsing gnutls: Vulnerability in GnuTLS certtool template parsing gnutls: gnutls: Remote Denial of Service via crafted ClientHello with invalid PSK binder
CVSS v3.1: 7.5
GHSA-46qx-xf9f-62gx: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5 and 3.7.2. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v3.1: 8.8
CVE-2017-9353: In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
CVSS v3.0: 7.5
CVSS v2.0: 5
PYSEC-2020-158: In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0.
PYSEC-2021-373: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
CVE-2013-0864: The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspecified impact via crafted GIF data that triggers an out-of-bounds array access.
CVSS v2.0: 10
CVE-2023-27605: WordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This issue affects WP Reroute Email: from n/a through 1.4.6.
CVSS v3.1: 5.5
PYSEC-2018-4: django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
CVE-2023-5509: myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
CVSS v3.1: 5.4
CVE-2008-1689: Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long request header in an HTTP request to TCP port 801.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 5
GHSA-4pm2-j7vr-cccw: NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS v3.1: 7.8
GHSA-78rj-mq5f-qp68: Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=.
CVSS v3.1: 7.2
CVE-2006-2709: Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remote attackers to (1) execute arbitrary code on a client or (2) forge messages to the server.
CVSS v2.0: 5
CVE-2022-25778: Unload handlers may unintentionally defeat CSRF guards
Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session.
CVSS v3.1: 4.2
GHSA-988h-mp33-6m53: The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.
CVSS v3.1: 8.1
GHSA-qpwh-qx3h-p3rq: The web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
GHSA-vvv2-p9hv-8634: An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information
CVSS v3.1: 7.5
CVE-2022-2901: Improper Authorization in chatwoot/chatwoot
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
CVSS v3.0: 7.6
CVE-2016-9064: Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
CVE-2017-10724: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries. The firmware contains binary uvc_stream that is the UDP daemon which is responsible for handling all the UDP requests that the device receives. The client application sends a UDP request to change the Wi-Fi name which contains the following format: "SETCMD0001+0002+[2 byte length of wifipassword]+[Wifipassword]. This request is handled by "control_Dev_thread" function which at address "0x00409AE4" compares the incoming request and determines if the 10th byte is 02 and if it is then it redirects to 0x0040A7D8, which calls the function "setwifipassword". The function "setwifipassword" uses a memcpy function but uses the length of the payload obtained by using strlen function as the third parameter which is the number of bytes to copy and this allows an attacker to overflow the function and control the $PC value.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2015-3750: WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
CVSS v2.0: 6.4
CVE-2008-4554: The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
CVSS v2.0: 4.6
CVE-2023-26213: On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.
CVSS v3.1: 7.2
GHSA-hwq9-6hwc-8v7g: In AutomationDirect C-MORE EA9 HMI,credentials used by the platform are stored as plain text on the device.
CVSS v3.1: 6.5
RHSA-2026:30085: Red Hat Security Advisory: perl-IO-Compress security update
perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob
CVSS v3.1: 7.8
CVE-2023-41842: A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet  allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.
CVSS v3.1: 6.3
GHSA-pvf8-wvcr-7547: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quitenicestuff Soho Hotel allows Reflected XSS. This issue affects Soho Hotel: from n/a through 4.2.5.
CVSS v3.1: 7.1
GHSA-4ghg-jxgx-f5gm: Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote attackers to insert script or HTML via an email message with the script in a MIME header name.
GHSA-5j7g-7744-jjx8: The Chat, Flirt & Dating Heart JAUMO (aka com.jaumo) application 2.7.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-89xf-9vcr-5475: In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.
CVSS v3.0: 8.8
CVE-2020-35742: HGiga MailSherlock - SQL Injection -1
HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.
CVSS v3.1: 7
GHSA-m5gh-3m95-wvqv: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
GHSA-gc4v-gj3r-jcjc: Dell EMC iDRAC8 versions 2.81.81 and earlier contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion, resulting in a denial of service (DoS) condition.
CVSS v3.1: 7.5
GHSA-vfp9-gwrh-wq9g: Path Traversal in crud-file-server
Versions of `crud-file-server` prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.RecommendationUpgrade to version 0.9.0 or later.
CVSS v3.1: 7.5
CVE-2019-7400: Rukovoditel before 2.4.1 allows XSS.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-j539-xxc6-73wf: Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.The built-in rand function is predictable, and unsuitable for cryptography.
CVSS v3.1: 7.5
GHSA-3f5q-7p2j-3w5g: The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter.
CVSS v3.1: 6.5
CVE-2020-18714: SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2024-33892: Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3
CVSS v3.1: 5.3
CVE-2007-1608: CRLF injection vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.19 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a single CRLF sequence in a context that is not a valid multi-line header.
CVSS v2.0: 7.5
CVE-2015-2509: Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
CVSS v2.0: 9.3
GHSA-grp8-p6j9-9x5f: MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-mpj7-7xpf-5v66: Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
CVSS v3.1: 3.7