ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-0878: Novel attack against the Combined Charging System (CCS) in electric vehicles to remotely cause a denial of service
Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the State of Charge (SoC) with the Electric Vehicle Supply Equipment (EVSE) CCS uses a high-bandwidth IP link provided by the HomePlug Green PHY (HPGP) power-line communication (PLC) technology. The attack interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack can be conducted wirelessly from a distance using electromagnetic interference, allowing individual vehicles or entire fleets to be disrupted simultaneously. In addition, the attack can be mounted with off-the-shelf radio hardware and minimal technical knowledge. With a power budget of 1 W, the attack is successful from around 47 m distance. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it. In addition to electric cars, Brokenwire affects electric ships, airplanes and heavy duty vehicles utilising these standards.
CVSS v3.1: 4.6
GHSA-56qh-f2pg-88cj: Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
CVSS v3.1: 6.1
GHSA-5fcx-fr87-m2w9: Firebird 1.5 allows remote authenticated users without SYSDBA and owner permissions to overwrite a database by creating a database.
RHSA-2015:0856: Red Hat Security Advisory: postgresql92-postgresql security update
postgresql: information leak through constraint violation errors postgresql: buffer overflow in the to_char() function postgresql: buffer overflow flaws in contrib/pgcrypto postgresql: loss of frontend/backend protocol synchronization after an error
CVE-2021-2301: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 2.7
GHSA-47p7-xfcc-4pv9: php-imap vulnerable to RCE through a directory traversal vulnerability
SummaryAn unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability which results in a remote code execution vulnerability.DetailsAn attacker can send an email with a malicious attachment to the inbox, which gets crawled with webklex/php-imap or webklex/laravel-imap. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)` (https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L251-L255).
In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback (https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L252).
Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package.
There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions.
The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron, requests,...
The official documentation only shows examples of `Attachment::save()` without providing the `$filename` (https://www.php-imap.com/api/attachment), which makes this vulnerability even more widespread.PoCsend an email with a malicious attachment to an inbox, which gets crawled by the packagecrawl email with malicious attachmentstore the attachment with `Attachment::save('/path/to/storage')` without providing a `$filename` valueImpactThis is a remote code execution vulnerability that is made possible through a directory traversal vulnerability.
Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack.
CVSS v3.1: 9
CVE-2023-45205: A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to `NT AUTHORITY/SYSTEM`.
CVSS v3.1: 7.8
GHSA-595p-g7xc-c333: Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
ImpactVersions of the Algolia Search & Discovery extension for Magento 2 prior to **3.17.2** and **3.16.2** contain a vulnerability where data read from the database was treated as a trusted source during job execution.If an attacker is able to modify records used by the extension’s indexing queue, this could result in **arbitrary PHP code execution** when the affected job is processed.Exploitation requires the ability to write malicious data to the Magento database and for the indexing queue to be enabled.PatchesThis vulnerability has been fixed in the following versions:**3.17.2****3.16.2**Merchants should upgrade to a supported patched version immediately.Versions outside the supported maintenance window do **not** receive security updates and remain vulnerable.WorkaroundsUpgrading to a patched version is the only recommended remediation.If an immediate upgrade is not possible, the following temporary risk mitigations may reduce exposure:Disable the Algolia indexing queue to prevent queued jobs from being executed.Restrict job execution logic to an explicit allowlist of permitted operations.Review the contents of the `algoliasearch_queue` table for unexpected or unrecognized entries.If queue archiving is enabled, review historical records in `algoliasearch_queue_archive`.These mitigations are provided as guidance only and do not replace upgrading to a patched version.ReferencesAlgolia Search & Discovery for Magento 2 releases:[3.16.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.16.2)[3.17.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.17.2)
CVSS v4.0: 6.9
GHSA-5m9v-2hhc-h2wj: Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.
CVSS v3.1: 4.3
GHSA-pmc3-v8x7-chwc: A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability could potentially allow attackers to gain unauthorized access to the database and extract sensitive information.
CVSS v3.1: 9.8
GHSA-pq4w-qm9g-qx68: Insufficient Nonce Validation in Eclipse Milo Client
ImpactCredential replay affecting those connected to a server when *all 3* of the following conditions are met:`SecurityPolicy` is `None`using username/password or X509-based authenticationthe server has a defect causing it to send null/empty or zeroed noncesPatchesThe problem has been patched in version `0.3.6`. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version `0.3.7`.WorkaroundsDo not use username/password or X509-based authentication with `SecurityPolicy` of `None`.Referenceshttps://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdfFor more informationIf you have any questions or comments about this advisory:Open an issue at [https://github.com/eclipse/milo/issues](https://github.com/eclipse/milo/issues)Email [the mailing list](mailto:milo-dev@eclipse.org)
CVSS v3.1: 7.4
CVE-2025-27955: Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
CVSS v3.1: 6.5
GHSA-w2fh-2f5m-c69g: In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.
CVSS v3.0: 4.3
CVE-2021-43908: Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
CVSS v3.1: 4.3
GHSA-74qp-233x-p5j8: Apache Livy Cross-site scripting (XSS) in session names
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
CVSS v3.1: 5.4
GHSA-5353-grp4-p243: Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
CVSS v3.1: 7.5
CVE-2021-37304: An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
CVSS v3.1: 7.5
CVE-2023-52999: net: fix UaF in netns ops registration error path
In the Linux kernel, the following vulnerability has been resolved:

net: fix UaF in netns ops registration error path

If net_assign_generic() fails, the current error path in ops_init() tries
to clear the gen pointer slot. Anyway, in such error path, the gen pointer
itself has not been modified yet, and the existing and accessed one is
smaller than the accessed index, causing an out-of-bounds error:

 BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320
 Write of size 8 at addr ffff888109124978 by task modprobe/1018

 CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x6a/0x9f
  print_address_description.constprop.0+0x86/0x2b5
  print_report+0x11b/0x1fb
  kasan_report+0x87/0xc0
  ops_init+0x2de/0x320
  register_pernet_operations+0x2e4/0x750
  register_pernet_subsys+0x24/0x40
  tcf_register_action+0x9f/0x560
  do_one_initcall+0xf9/0x570
  do_init_module+0x190/0x650
  load_module+0x1fa5/0x23c0
  __do_sys_finit_module+0x10d/0x1b0
  do_syscall_64+0x58/0x80
  entry_SYSCALL_64_after_hwframe+0x72/0xdc
 RIP: 0033:0x7f42518f778d
 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
       89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
       ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48
 RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
 RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d
 RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003
 RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
 R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000
  </TASK>

This change addresses the issue by skipping the gen pointer
de-reference in the mentioned error-path.

Found by code inspection and verified with explicit error injection
on a kasan-enabled kernel.
CVSS v3.1: 7.8
RHSA-2017:2389: Red Hat Security Advisory: freeradius security update
freeradius: Out-of-bounds read/write due to improper output buffer size check in make_secret() freeradius: Out-of-bounds read in fr_dhcp_decode() when decoding option 63 freeradius: Out-of-bounds write in data2vp_wimax() freeradius: Infinite loop and memory exhaustion with 'concat' attributes freeradius: Infinite read in dhcp_attr2vp() freeradius: Buffer over-read in fr_dhcp_decode_suboptions()
CVSS v3.0: 5.9
GHSA-5f56-h6fg-rcrh: Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVSS v3.1: 8.8
GHSA-cv52-3f6r-76gp: Sympa before 6.2.56 allows privilege escalation.
CVSS v3.1: 7.8
GHSA-hvp9-6mxp-9797: Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS v3.1: 7.8
CVE-2021-41114: HTTP Host Header Injection in Request Handling in Typo3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.
CVSS v3.1: 4.8
CVE-2026-31538: smb: server: make use of smbdirect_socket.recv_io.credits.available
In the Linux kernel, the following vulnerability has been resolved:

smb: server: make use of smbdirect_socket.recv_io.credits.available

The logic off managing recv credits by counting posted recv_io and
granted credits is racy.

That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.

So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.

This fixes regression Namjae reported with
the 6.18 release.
CVSS v3.1: 7.5
GHSA-g75p-4v96-pxff: An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mapping to the calling domain exists for the page in question. However, the function does not check to see if the owning domain actually has a grant table or not. Some special domains, such as `DOMID_XEN`, `DOMID_IO` and `DOMID_COW` are created without grant tables. Hence, if __gnttab_cache_flush operates on a page owned by these special domains, it will attempt to dereference a NULL pointer in the domain struct.
CVSS v3.0: 6.5
CVE-1999-1139: Character-Terminal User Environment (CUE) in HP-UX 11.0 and earlier allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the IOERROR.mytty file.
CVSS v2.0: 7.2
RHSA-2024:7487: Red Hat Security Advisory: go-toolset:rhel8 security update
encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion
CVSS v3.1: 7.5
GHSA-52h2-329h-239p: Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase Administration Services. While the vulnerability is in Oracle Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Essbase Administration Services. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
GHSA-7w5c-h3p4-5gm9: Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
CVSS v3.0: 7.4
GHSA-mw66-q494-6v6w: iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
CVSS v3.1: 9.8
GHSA-2qf2-mq6q-w69h: Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending unexpected null bytes in order to read memory on the system.
CVSS v3.1: 2.3
CVE-2026-33551: An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
CVSS v3.1: 3.5
GHSA-vpwh-qmwc-2phg: ProcessWire vulnerable to Cross-Site Request Forgery
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).
CVSS v3.1: 6.5
CVE-2016-0465: Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect availability via unknown vectors related to Resource Group Manager.
CVSS v2.0: 4.9
CVE-2013-1599: A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2019-14405: cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2018:0051: Red Hat Security Advisory: rhevm-setup-plugins security, bug fix, and enhancement update
An update for rhevm-setup-plugins is now available for RHEV Engine version 4.1.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
CVE-2021-23370: Prototype Pollution
This affects the package swiper before 6.5.1.
CVSS v3.1: 7.5
GHSA-wx9v-xq78-r94h: Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a denial of service (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice.
CVE-2014-2967: Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.
CVSS v2.0: 10
CVE-2025-59288: Playwright Spoofing Vulnerability
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
CVSS v3.1: 5.3
GHSA-w4wq-5jxq-9m44: The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
GHSA-q95x-v9cp-2p83: Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
CVSS v3.0: 9.8
ICSA-23-005-03: Hitachi Energy Lumada Asset Performance Management
The affected versions of Lumada APM rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. In Lumada APM, this can be triggered by configuring APM to connect to a malicious server for one of the supported integrations. This may cause a crash of the specific APM service implementing the integration (causing a denial of service).CVE-2022-3602 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected versions of Lumada APM rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. In Lumada APM, this can be triggered by configuring APM to connect to a malicious server for one of the supported integrations. This may cause a crash of the specific APM service implementing the integration (causing a denial of service).CVE-2022-3786 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
 The affected versions of Lumada APM rely on a version of zlib that contains an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in denial of service or potentially the execution of arbitrary code.CVE-2022-37434 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 7.5
CVE-2023-25446: WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.
CVSS v3.1: 7.7
GHSA-x8hp-rjr5-68q5: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 9.8
GHSA-fqr7-2x83-wf2r: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
CVSS v3.1: 8.1
CVE-2025-14861: Memory safety bugs fixed in Firefox 146.0.1
Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1.
CVSS v3.1: 8.8