ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-xv98-fj8w-837g: The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function,  tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2023-3171: Eap-7: heap exhaustion via deserialization
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
CVSS v3.1: 7.5
PYSEC-2022-43172: The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS v3.1: 9.8
CVE-2018-6893: controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-fpf6-h79m-m599: Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
CVE-2020-7116: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
CVSS v3.1: 7.2
CVSS v2.0: 9
CVE-2022-2655: Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS v3.1: 6.1
RHSA-2021:0611: Red Hat Security Advisory: xterm security update
xterm: crash when processing combining characters
CVSS v3.1: 9.6
CVE-2010-2402: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.27 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v2.0: 5.5
CVE-2019-10009: A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2025-57709: Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
CVSS v4.0: 1.3
RHSA-2025:15832: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)
vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service python-pillow: pillow: Pillow DDS Heap Buffer Overflow
CVSS v3.1: 7.1
GHSA-wpfp-vfwj-4xwh: In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
CVSS v3.1: 5.4
GHSA-2356-6r88-539v: A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. .
CVE-2019-12552: In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2018-0633: Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-h6gw-mwpr-89hw: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2019-3915: Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain access to the administrative web interface.
CVSS v3.0: 7.5
CVSS v2.0: 5.4
CVE-2026-46470: An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
CVSS v3.1: 4
RHSA-2020:4235: Red Hat Security Advisory: chromium-browser security update
chromium-browser: Inappropriate implementation in networking chromium-browser: Use after free in payments chromium-browser: Use after free in Blink chromium-browser: Use after free in WebRTC chromium-browser: Use after free in NFC chromium-browser: Use after free in printing chromium-browser: Use after free in audio chromium-browser: Insufficient policy enforcement in extensions chromium-browser: Integer overflow in Blink chromium-browser: Integer overflow in SwiftShader chromium-browser: Use after free in WebXR chromium-browser: Insufficient data validation in dialogs chromium-browser: Insufficient data validation in navigation chromium-browser: Inappropriate implementation in V8 chromium-browser: Insufficient policy enforcement in Intents chromium-browser: Out of bounds read in audio chromium-browser: Side-channel information leakage in cache chromium-browser: Insufficient data validation in webUI chromium-browser: Insufficient policy enforcement in Omnibox chromium-browser: Inappropriate implementation in Blink chromium-browser: Integer overflow in media chromium-browser: Use after free in WebRTC chromium-browser: Insufficient policy enforcement in downloads chromium-browser: Uninitialized use in PDFium chromium-browser: Use after free in autofill chromium-browser: Use after free in password manager chromium-browser: Insufficient policy enforcement in networking
CVSS v3.1: 8.8
CVE-2018-1614: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote attacker to obtain sensitive information. IBM X-Force ID: 144270.
CVSS v3.0: 5.8
CVE-2013-1911: lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
CVSS v2.0: 6.8
GHSA-gq9v-6frh-4qfx: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later
CVSS v3.1: 3.8
CVE-2001-1118: A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allow a remote attacker to execute arbitrary commands or view arbitrary files via an encoded URL.
CVSS v2.0: 7.5
GHSA-rxx5-6r7x-q8xv: In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.
CVSS v3.1: 9.8
CVE-2005-2767: Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.
CVSS v2.0: 7.5
GHSA-4vc4-6jgc-cg63: Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long volume name in a DMG disk image, which results in memory corruption.
RHSA-2025:0907: Red Hat Security Advisory: ACS 4.6.2 enhancement and security update
golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies
CVSS v3.1: 7.5
GHSA-3m95-wfxh-25xv: Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cryptocurrency Widgets Pack: from n/a through 2.0.1.
CVSS v3.1: 6.5
CVE-2017-15572: In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2024-35961: net/mlx5: Register devlink first under devlink lock
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Register devlink first under devlink lock

In case device is having a non fatal FW error during probe, the
driver will report the error to user via devlink. This will trigger
a WARN_ON, since mlx5 is calling devlink_register() last.
In order to avoid the WARN_ON[1], change mlx5 to invoke devl_register()
first under devlink lock.

[1]
WARNING: CPU: 5 PID: 227 at net/devlink/health.c:483 devlink_recover_notify.constprop.0+0xb8/0xc0
CPU: 5 PID: 227 Comm: kworker/u16:3 Not tainted 6.4.0-rc5_for_upstream_min_debug_2023_06_12_12_38 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Workqueue: mlx5_health0000:08:00.0 mlx5_fw_reporter_err_work [mlx5_core]
RIP: 0010:devlink_recover_notify.constprop.0+0xb8/0xc0
Call Trace:
 <TASK>
 ? __warn+0x79/0x120
 ? devlink_recover_notify.constprop.0+0xb8/0xc0
 ? report_bug+0x17c/0x190
 ? handle_bug+0x3c/0x60
 ? exc_invalid_op+0x14/0x70
 ? asm_exc_invalid_op+0x16/0x20
 ? devlink_recover_notify.constprop.0+0xb8/0xc0
 devlink_health_report+0x4a/0x1c0
 mlx5_fw_reporter_err_work+0xa4/0xd0 [mlx5_core]
 process_one_work+0x1bb/0x3c0
 ? process_one_work+0x3c0/0x3c0
 worker_thread+0x4d/0x3c0
 ? process_one_work+0x3c0/0x3c0
 kthread+0xc6/0xf0
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x1f/0x30
 </TASK>
CVSS v3.1: 5.5
ICSA-14-294-01: Rockwell Automation Connected Components Workbench ActiveX Component Vulnerabilities
Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler.
GHSA-c6r7-vwx9-8xmh: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
CVSS v3.1: 4.7
CVE-2024-23486: Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.
CVSS v3.1: 9.8
CVE-2017-5449: A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2004-2567: Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.
CVSS v2.0: 7.5
CVE-2025-54226: InDesign Desktop | Use After Free (CWE-416)
InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-gf6p-963f-gv5h: Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS v3.1: 8.8
CVE-2023-23710: WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
CVSS v3.1: 5.9
GHSA-36mf-gmc7-cfv9: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
GHSA-9x83-h62w-jvx7: In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
GHSA-q9r4-5jf5-vgf6: Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary web script or HTML via the username.
VA-25-119-01: MSP360 Backup insecure filesystem permissions
An insecure file system permissions vulnerability in MSP360 Backup (for Linux) 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' directory. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22). An insecure file system permissions vulnerability in MSP360 Backup (for Windows) 8.0 allows a low privileged user to execute commands with SYSTEM privileges. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).
CVSS v3.1: 7.8
RHSA-2023:1889: Red Hat Security Advisory: java-11-openjdk security update
OpenJDK: improper connection handling during TLS handshake (8294474) OpenJDK: missing string checks for NULL characters (8296622) OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) OpenJDK: Swing HTML parsing issue (8296832) OpenJDK: incorrect enqueue of references in garbage collector (8298191) OpenJDK: certificate validation issue in TLS session negotiation (8298310) OpenJDK: missing check for slash characters in URI-to-path conversion (8298667)
CVSS v3.1: 3.7
GHSA-rfjw-v9v6-85r7: Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.
CVSS v3.1: 8.8
GHSA-9mrf-w63c-fxfh: A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). Both the SiNVR 3 Video Server and the Central Control Server (CCS) store user and device passwords by applying weak cryptography. A local attacker could exploit this vulnerability to extract the passwords from the user database and/or the device configuration files to conduct further attacks.
CVSS v3.1: 5.5
CVE-2002-0729: Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator.
CVSS v2.0: 5
CVE-2008-3369: SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
CVSS v2.0: 7.5
CVE-2013-5188: The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a transition out of hibernation, which allows physically proximate attackers to obtain access by visiting an unattended workstation in the hibernating state.
CVSS v2.0: 4
GHSA-g349-hgx7-9cj9: An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.
CVSS v3.1: 7.5
GHSA-wc7j-ww93-98v3: Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 8.8
GHSA-5q93-m8w2-xmp8: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
CVSS v3.1: 7.1
CVE-2021-23432: Prototype Pollution
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
CVSS v3.1: 5.4
GHSA-vqmq-g46j-863w: netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
CVSS v3.0: 9.8
CVE-2024-20753: Adobe Photoshop PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Photoshop Desktop versions 24.7.3, 25.7 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2024-33564: WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
CVSS v3.1: 8.8
GHSA-r72h-j3wg-jrp4: An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
GHSA-3jhf-59jq-5cpv: Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.
GHSA-8f2f-mjxj-j85g: Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users.
GHSA-xgq6-34c9-2m62: An elevation of privilege vulnerability exists when the &quot;Public Account Pictures&quot; folder improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0776.
GHSA-294x-764g-q87f: In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
CVSS v3.0: 6.5
CVE-2002-1011: Buffer overflow in web server for Tivoli Management Framework (TMF) Endpoint 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET request.
CVSS v2.0: 7.5
GHSA-j78r-6pr7-56vm: The SHIRAKABA (aka com.SHIRAKABA) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-8pxc-f3fr-64vr: Cross-site request forgery (CSRF) vulnerability in util_system.html in Belkin N900 router allows remote attackers to hijack the authentication of administrators for requests that change configuration settings including passwords and remote management ports.
RHSA-2025:19423: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)
cpython: Cpython infinite loop when parsing a tarfile setuptools: Path Traversal Vulnerability in setuptools PackageIndex vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars
CVSS v3.1: 7.5
GHSA-m3j7-7x7f-j7pf: Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
CVE-2024-48768: An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process
CVSS v3.1: 7.5
GHSA-hxw5-pvw5-67pp: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: skip netdev events generated on netns removalsyzbot reported following (harmless) WARN:WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468
  nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline]
  nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline]
  __nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524
  nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline]
  nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382reproducer:
unshare -n bash -c 'ip link add br0 type bridge; nft add table netdev t ; \
 nft add chain netdev t ingress \{ type filter hook ingress device "br0" \
 priority 0\; policy drop\; \}'Problem is that when netns device exit hooks create the UNREGISTER
event, the .pre_exit hook for nf_tables core has already removed the
base hook.  Notifier attempts to do this again.The need to do base hook unregister unconditionally was needed in the past,
because notifier was last stage where reg->dev dereference was safe.Now that nf_tables does the hook removal in .pre_exit, this isn't
needed anymore.
CVSS v3.1: 5.5
GHSA-9q6j-4fr7-7x67: A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device.