ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2018-2756: Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: WebUI). Supported versions that are affected are 7.2.4.3.0, 7.3.0.1.x, 7.3.1.0.7 and 7.3.5.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Order and Service Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data. CVSS 3.0 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N).
CVSS v3.0: 6.3
CVSS v2.0: 4.9
GHSA-62f8-j3hg-8hcg: The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222, as used in Google Chrome before 11.0.696.43 and other products, does not properly handle access to the (1) counterIncrement and (2) counterReset attributes of CSSStyleDeclaration data provided by a getComputedStyle method call, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code.
CVE-2025-3116: CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends special malformed HTTPS request containing improper formatted body
data to the controller.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-73p2-7vjh-9qx4: There is a Cross-site Scripting vulnerability in Esri Portal Sites in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser.  The privileges required to execute this attack are high.
CVSS v3.1: 8.4
CVE-2014-8166: The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
CVSS v3.1: 8.8
CVSS v2.0: 5.1
CVE-2023-27631: WordPress Daily Prayer Time Plugin <= 2023.05.04 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.
CVSS v3.1: 6.5
GHSA-2hjr-wwf2-rh3g: Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745.
GHSA-3rfw-27f2-r488: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. This is due to a flawed state validation mechanism that fails open when input is sanitized by wp_kses(), combined with insufficient output escaping. The state validation logic creates two hashes (raw input and wp_kses-sanitized input) and only fails validation if BOTH hashes don't match the original state. When an attacker injects XSS payloads using tags stripped by wp_kses() (like <svg>), the sanitized hash matches while the malicious raw value is preserved and saved to the database. When administrators view the Entries List page, the stored malicious consent label is retrieved and output without escaping, causing the XSS payload to execute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in entries that will execute whenever an authenticated administrator accesses the entries list page.
CVSS v3.1: 7.2
RHSA-2020:3456: Red Hat Security Advisory: libvncserver security update
libvncserver: websocket decoding buffer overflow
CVSS v3.1: 9.8
GHSA-p723-w3qm-qpvw: Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access.
GHSA-xrrw-9j78-hpf3: Jenkins HTML Publisher Plugin Stored XSS vulnerability
Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS v3.1: 8
GHSA-frvc-2mm7-vwcg: Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors related to DHTML.  NOTE: due to the lack of sufficient public details from the vendor as of 20060413, it is unclear how CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, and CVE-2006-1723 are different.
GHSA-c96h-4jr8-99gm: IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks.  IBM X-Force ID:  268270.
CVSS v3.1: 6.2
GHSA-frx9-m86f-mhgc: Cross-site scripting (XSS) vulnerability in Alt-N MDaemon WorldClient 10.0.2, when Internet Explorer 7 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted img tag.
RHSA-2024:7700: Red Hat Security Advisory: firefox security update
firefox: Clipboard write permission bypass firefox: thunderbird: Compromised content process can bypass site isolation firefox: thunderbird: Cross-origin access to PDF contents through multipart responses firefox: thunderbird: Cross-origin access to JSON contents through multipart responses firefox: thunderbird: Potential memory corruption may occur when cloning certain objects firefox: thunderbird: Potential directory upload bypass via clickjacking firefox: thunderbird: External protocol handlers could be enumerated via popups firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service firefox: thunderbird: Potential memory corruption during JIT compilation firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
CVSS v3.1: 7.5
CVE-2004-1358: The patches (1) 114332-08 and (2) 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module (BSM), which allows attackers to avoid having their activity logged.
CVSS v2.0: 5
CVE-2017-17984: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
CVSS v3.0: 4.8
CVSS v2.0: 3.5
GHSA-wmrm-h25f-p3q4: A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-4pg2-ppcx-jh29: In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
CVSS v3.1: 5.9
CVE-2017-12478: It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-95gw-69j9-7r85: Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. 
Moreover, the system does not destroy the old sessions when creating new ones, what expands the time frame in which an attack might be performed. 
This vulnerability has been patched in version 79.0
CVSS v4.0: 2.3
CVSS v3.1: 4.4
CVE-2023-43796: Synapse vulnerable to leak of remote user device information
Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.
CVSS v3.1: 5.3
GHSA-mqj3-hp36-pg28: MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.
GHSA-pwcg-c8g4-qgxx: The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 5.4
CVE-2006-3245: Multiple cross-site scripting (XSS) vulnerabilities in activatemember in mvnForum 1.0 GA and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) member and (2) activatecode parameters.
CVSS v2.0: 2.6
GHSA-qr99-7898-vr7c: Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
SummaryThere is a potential vulnerability in Traefik's Basic and Digest authentication middlewares when `headerField` is configured with a non-canonical HTTP header name.An authenticated attacker with valid credentials can inject the canonical version of the configured header to impersonate any identity to the backend. Because Traefik writes the authenticated username using a non-canonical map key, it creates a separate header entry rather than overwriting the attacker's canonical one — causing most backend frameworks to read the attacker-controlled value instead.Patches<https://github.com/traefik/traefik/releases/tag/v2.11.42><https://github.com/traefik/traefik/releases/tag/v3.6.12><https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3>For more informationIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).SummaryWhen `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject a canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write.Tested on Traefik v3.6.10.DetailsAt `pkg/middlewares/auth/basic_auth.go:92`, the authenticated username is written using direct map assignment:Go's `http.Header` map is keyed by canonical names (e.g., `X-Auth-User`). Direct assignment with a non-canonical key (`x-auth-user`) creates a separate map entry from any canonical-key entry already present. The attacker's `X-Auth-User: superadmin` occupies the canonical slot and is never overwritten by Traefik's non-canonical write.The same bug exists in `pkg/middlewares/auth/digest_auth.go:100`. Notably, `forward.go:254` correctly uses `http.CanonicalHeaderKey()`, showing the fix pattern already exists in the codebase.PoC**Traefik config (YAML, Docker labels, or REST API):****Normal request (baseline):****Attack request:****Control test** — when `headerField` uses canonical casing (`X-Auth-User`), the attack fails. Traefik's write correctly overwrites the attacker's header.This is realistic because YAML conventions favor lowercase keys, Traefik docs don't warn about canonicalization, and the pattern of backends trusting the `headerField` header is recommended in Traefik's own documentation.**Fix suggestion:**Also strip any incoming `headerField` header before the auth check with `req.Header.Del(b.headerField)`.ImpactAn authenticated attacker with valid credentials (even low-privilege) can impersonate any other user identity to backend services. If backends use the `headerField` header for authorization decisions (which is the intended use case per Traefik docs), this enables privilege escalation — e.g., a regular user impersonating an admin.The attack requires the operator to configure `headerField` with a non-canonical header name, which is the natural thing to do in YAML and is not warned against in documentation.
CVSS v4.0: 5.1
CVE-2023-23849: Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C
CVSS v3.1: 8.1
RHSA-2022:4668: Red Hat Security Advisory: OpenShift Virtualization 4.10.1 Images security and bug fix update
golang: net/http/httputil: panic due to racy read of persistConn after handler panic opencontainers: OCI manifest and index parsing confusion prometheus/client_golang: Denial of service using InstrumentHandlerCounter
CVSS v3.1: 7.5
CVE-2019-5137: The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware version 1.13.
CVSS v3.0: 7.5
GHSA-53q2-mqcg-jhm2: Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2023-6279: Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS
The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
CVSS v3.1: 7.1
GHSA-fhch-vffp-hj8x: In the Linux kernel, the following vulnerability has been resolved:KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUNFor guests with NRIPS disabled, L1 does not provide NextRIP when running
an L2 with an injected soft interrupt, instead it advances the current RIP
before running it. KVM uses the current RIP as the NextRIP in vmcb02 to
emulate a CPU without NRIPS.However, after L2 runs the first time, NextRIP will be updated by the CPU
and/or KVM, and the current RIP is no longer the correct value to use in
vmcb02.  Hence, after save/restore, use the current RIP if and only if a
nested run is pending, otherwise use NextRIP.  Give soft_int_next_rip the
same treatment, as it's the same logic, just for a narrower use case.[sean: give soft_int_next_rip the same treatment]
CVSS v3.1: 5.5
RHSA-2019:0447: Red Hat Security Advisory: Red Hat Enterprise Linux 7.4 Extended Update Support (EUS) Six-month Notice
This is the six-month notification for the retirement of Red Hat Enterprise Linux 7.4 Extended Update Support (EUS). This notification applies only to those customers subscribed to the Extended Update Support (EUS) channel for Red Hat Enterprise Linux 7.4.
CVE-2017-3240: Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where RDBMS Security executes to compromise RDBMS Security. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS Security accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
CVSS v3.0: 3.3
CVSS v2.0: 2.1
CVE-2014-8363: SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
CVSS v2.0: 7.5
GHSA-vx86-wgxh-78rp: Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
CVE-2025-24496: An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.
CVSS v3.1: 7.5
CVE-2023-43617: An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
CVSS v3.1: 5.3
GHSA-w42f-w92v-v257: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php of the component Edit Subdomain Details Page. The manipulation of the argument sadminusername/fullname/emailid/mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "mobilenumber" to be affected. But it must be assumed that other parameters are affected as well.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2023-37360: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).
CVSS v3.1: 5.9
CVE-2013-3614: Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS v2.0: 9.3
GHSA-hg69-x38h-39g2: The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the uucss_update_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-v58c-j43c-7cpx: Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.
ICSA-26-148-06: KMW CCTV Security Cameras
The affected product is vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the camera feeds and settings.
CVSS v3.1: 9.1
CVE-2025-68671: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.
CVSS v3.1: 6.5
GHSA-3j97-8r9f-j629: Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.5.
CVSS v3.1: 5.4
CVE-2009-1763: Unspecified vulnerability in the Solaris Secure Digital slot driver (aka sdhost) in Sun OpenSolaris snv_105 through snv_108 on the x86 platform allows local users to gain privileges or cause a denial of service (filesystem or memory corruption) via unknown vectors.
CVSS v2.0: 7.2
RHSA-2008:0243: Red Hat Security Advisory: java-1.4.2-bea security update
Untrusted applet and application XSLT processing privilege escalation
CVE-2025-21998: firmware: qcom: uefisecapp: fix efivars registration race
In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: fix efivars registration race

Since the conversion to using the TZ allocator, the efivars service is
registered before the memory pool has been allocated, something which
can lead to a NULL-pointer dereference in case of a racing EFI variable
access.

Make sure that all resources have been set up before registering the
efivars.
CVSS v3.1: 4.7
GHSA-7wc7-88gj-j34j: D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
CVSS v3.1: 9.8
GHSA-2wvp-q72m-cfq8: Cross-site scripting (XSS) vulnerability in config.php in AdaptCMS 2.0.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-9qpg-6x42-3rc4: The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
CVSS v3.1: 5.3
CVE-2016-0836: Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590.
CVSS v3.0: 7.8
CVSS v2.0: 10
GHSA-gxg4-hv34-jxp7: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-m728-52w7-3gvf: Buffer overflow in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a long string that triggers construction of a long text run.
RHSA-2016:2947: Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39 flash-plugin: multiple code execution issues fixed in APSB16-39
CVSS v3.0: 8.8