ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vpwx-h6w7-p6j9: A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file /forget_password_process.php. The manipulation of the argument unm leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 9.8
GHSA-9g43-hm8v-4vhj: A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.16 and below; Aruba Instant 8.3.x: 8.3.0.12 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS v3.1: 8.8
CVE-2007-1706: SQL injection vulnerability in eWebQuiz.asp in eWebQuiz 8 allows remote attackers to execute arbitrary SQL commands via the QuizID parameter.
CVSS v2.0: 7.5
GHSA-r88r-x2j2-hw6q: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker allows Stored XSS.This issue affects WP Poll Maker: from n/a through 3.1.
CVSS v3.1: 5.9
CVE-2018-13422: TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-258h-f687-4226: PheonixAppAPI has visible Encoding Maps
ImpactThis is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc.The issue is that the map of encoding/decoding languages are visible in code.PatchesThe Problem was patched in 0.2.5, so you should try to upgrade to the 0.2.5 version.For 0.2.5 version usersPlease run the post_install.py file inside the Scripts folder after downloading from pip.WorkaroundsThere is a fix to this problem but it requires modifying the code. Modifying the code can lead to more issues.ReferencesThere are currently no references to this problem.NOTE: If you get a error regarding a function like -> get_key() or something like that, please re-run the file post_install.py inside Scripts folder
CVSS v4.0: 5.3
CVSS v3.1: 4.4
CVE-2001-0597: Zetetic Secure Tool for Recalling Important Passwords (STRIP) 0.5 and earlier for the PalmOS allows a local attacker to recover passwords via a brute force attack.  This attack is made feasible by STRIP's use of SysRandom, which is seeded by TimeGetTicks, and an implementation flaw which vastly reduces the password 'search space'.
CVSS v2.0: 7.2
CVE-2025-8246: TOTOLINK X15 HTTP POST Request formRoute buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2026-34507: OpenClaw < 2026.4.29  - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks
OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.
CVSS v4.0: 2.3
CVSS v3.1: 5.4
CVE-2023-31161: Improper Input Validation in Web Interface
An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow an authenticated remote attacker to use internal resources, allowing a variety of potential effects.

See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS v3.1: 5.9
CVE-2023-31073: WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
CVSS v3.1: 4.3
CVE-2017-7531: In Moodle 3.3, the course overview block reveals activities in hidden courses.
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2024-6529: Ultimate Classified Listings < 1.4 - Reflected XSS
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 7.1
GHSA-mp9x-38wj-vmf3: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33862021.
CVSS v3.0: 7.8
CVE-2023-52954: Vulnerability of improper permission control in the Gallery module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 4.4
CVE-2018-3150: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS v3.0: 3.7
CVSS v2.0: 4.3
GHSA-xgmc-wh79-m824: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php.
CVSS v3.1: 9.8
GHSA-7768-324v-qm6c: The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.
GHSA-839m-p94h-vmw7: A elevation of privilege vulnerability in the Qualcomm proprietary component. Product: Android. Versions: Android kernel. Android ID: A-32524214. References: QC-CR#2044821.
CVSS v3.0: 7.8
GHSA-4fj3-hvj6-pj6h: A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2022-50310: ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed
In the Linux kernel, the following vulnerability has been resolved:

ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed

If the initialization fails in calling addrconf_init_net(), devconf_all is
the pointer that has been released. Then ip6mr_sk_done() is called to
release the net, accessing devconf->mc_forwarding directly causes invalid
pointer access.

The process is as follows:
setup_net()
	ops_init()
		addrconf_init_net()
		all = kmemdup(...)           ---> alloc "all"
		...
		net->ipv6.devconf_all = all;
		__addrconf_sysctl_register() ---> failed
		...
		kfree(all);                  ---> ipv6.devconf_all invalid
		...
	ops_exit_list()
		...
		ip6mr_sk_done()
			devconf = net->ipv6.devconf_all;
			//devconf is invalid pointer
			if (!devconf || !atomic_read(&devconf->mc_forwarding))

The following is the Call Trace information:
BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0
Read of size 4 at addr ffff888075508e88 by task ip/14554
Call Trace:
<TASK>
dump_stack_lvl+0x8e/0xd1
print_report+0x155/0x454
kasan_report+0xba/0x1f0
kasan_check_range+0x35/0x1b0
ip6mr_sk_done+0x112/0x3a0
rawv6_close+0x48/0x70
inet_release+0x109/0x230
inet6_release+0x4c/0x70
sock_release+0x87/0x1b0
igmp6_net_exit+0x6b/0x170
ops_exit_list+0xb0/0x170
setup_net+0x7ac/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f7963322547

</TASK>
Allocated by task 14554:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0xa1/0xb0
__kmalloc_node_track_caller+0x4a/0xb0
kmemdup+0x28/0x60
addrconf_init_net+0x1be/0x840
ops_init+0xa5/0x410
setup_net+0x5aa/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 14554:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x155/0x1b0
slab_free_freelist_hook+0x11b/0x220
__kmem_cache_free+0xa4/0x360
addrconf_init_net+0x623/0x840
ops_init+0xa5/0x410
setup_net+0x5aa/0xbd0
copy_net_ns+0x2e6/0x6b0
create_new_namespaces+0x382/0xa50
unshare_nsproxy_namespaces+0xa6/0x1c0
ksys_unshare+0x3a4/0x7e0
__x64_sys_unshare+0x2d/0x40
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS v3.1: 7.8
GHSA-5xhh-fjfj-vrw4: In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931
CVSS v3.1: 5.5
CVE-2007-5554: Oracle allows remote attackers to obtain server memory contents via crafted packets, aka Oracle reference number 7892711.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVSS v2.0: 7.1
CVE-2013-2349: Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1896.
CVSS v2.0: 10
CVE-2008-2406: The administration application server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port 5102.
CVSS v2.0: 7.5
CVE-2023-6510: Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-62f6-wgjc-3prq: Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.
GHSA-8gfg-pqqx-3q76: SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action.
CVE-2021-31260: The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2026-20994: URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.
CVSS v4.0: 6.9
GHSA-jr4h-hc9r-9rr3: Windows LSA Spoofing Vulnerability.
CVSS v3.1: 8.1
CVE-2013-0381: Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Application Framework.
CVSS v2.0: 6.4
CVE-2022-47376: The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
CVSS v3.1: 7.3
CVE-2024-39539: Junos OS: MX Series: Continuous subscriber logins will lead to a memory leak and eventually an FPC crash
A Missing Release of Memory after Effective Lifetime vulnerability in Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).

In a subscriber management scenario continuous subscriber logins will trigger a memory leak and eventually lead to an FPC crash and restart.

This issue affects Junos OS on MX Series:



  *  All version before 21.2R3-S6,
  *  21.4 versions before 21.4R3-S6,
  *  22.1 versions before 22.1R3-S5,
  *  22.2 versions before 22.2R3-S3, 
  *  22.3 versions before 22.3R3-S2,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.
CVSS v4.0: 6
CVSS v3.1: 5.3
GHSA-c4wq-769x-vwcv: A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."
CVSS v4.0: 1.9
CVSS v3.1: 3.3
GHSA-w56w-4mw9-32p3: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
CVSS v3.1: 4.3
CVE-2023-29359: GDI Elevation of Privilege Vulnerability
GDI Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2024-38422: Integer Overflow to Buffer Overflow in Audio
Memory corruption while processing voice packet with arbitrary data received from ADSP.
CVSS v3.1: 7.8
GHSA-r7m2-3jgc-7x2c: In the Linux kernel, the following vulnerability has been resolved:ASoC: SDCA: Fix errors in IRQ cleanupIRQs are enabled through sdca_irq_populate() from component probe
using devm_request_threaded_irq(), this however means the IRQs can
persist if the sound card is torn down. Some of the IRQ handlers
store references to the card and the kcontrols which can then
fail. Some detail of the crash was explained in [1].Generally it is not advised to use devm outside of bus probe, so
the code is updated to not use devm. The IRQ requests are not moved
to bus probe time as it makes passing the snd_soc_component into
the IRQs very awkward and would the require a second step once the
component is available, so it is simpler to just register the IRQs
at this point, even though that necessitates some manual cleanup.
CVSS v3.1: 5.5
CVE-2026-28857: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS v3.1: 6.5
GHSA-rwm7-xhj3-2xjv: The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary customer invoices by enumerating sequential post IDs, exposing sensitive billing PII including full name, email address, phone number, order total, line items, and customer notes belonging to other customers.
CVSS v3.1: 4.3
GHSA-v5v2-65jc-4g4f: ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges.
CVE-2008-0086: Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.
CVSS v2.0: 9
GHSA-qh8m-9qxx-53m5: CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
ImpactThe `PaginatorHelper::limitControl()` method has a cross-site-scripting vulnerability via query string parameter manipulation.PatchesThis issue has been fixed in 5.2.12 and 5.3.1WorkaroundsIf you are unable to upgrade, you should avoid using `Paginator::limitControl()` until you can upgrade.
CVSS v3.1: 5.4
CVE-2024-43562: Windows Network Address Translation (NAT) Denial of Service Vulnerability
Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-395v-m46g-95rq: Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2022-38251: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.
CVSS v3.1: 4.8
CVE-2022-22427: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 223720.
CVSS v3.0: 5.2
GHSA-cf94-c7h7-gf34: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6. An app may be able to access protected user data.
CVSS v3.1: 5.5
CVE-2017-9061: In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2011-1826: Open redirect vulnerability in the Administrative Console in CA Arcot WebFort Versatile Authentication Server (VAS) before 6.2.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS v2.0: 5.8
CVE-2021-41373: FSLogix Information Disclosure Vulnerability
FSLogix Information Disclosure Vulnerability
CVSS v3.1: 5.5
RHSA-2024:10273: Red Hat Security Advisory: kernel security update
kernel: vsock: remove vsock from connected table when connect is interrupted by a signal
CVSS v3.1: 4.4
GHSA-7hgc-php5-77qq: Talos worker join token can be used to get elevated access level to the Talos API
ImpactTalos worker nodes use a join token to get accepted into the Talos cluster. A misconfigured Kubernetes environment may allow workloads to access the join token of the worker node. A malicious workload could then use the join token to construct a Talos CSR (certificate signing request). Due to improper validation while signing a worker node CSR, a Talos control plane node might issue a Talos certificate which allows full access to the Talos API to a worker node that presented a maliciously constructed CSR. Accessing the Talos API with full access on a control plane node might reveal sensitive information, which could allow full-level access to the cluster (Kubernetes and Talos PKI, etc.)In order to exploit the weakness, a Kubernetes workload would need to access the join token, and then construct a specific kind of Talos CSR in order to obtain a privileged certificate. The Talos API join token is stored in the machine configuration on the worker node. When configured correctly, Kubernetes workloads do not have access to the machine configuration, and thus cannot access the token, nor acquire elevated privileges.It is possible that users have misconfigured Kubernetes in such a way as to allow a workload to access the machine configuration and reveal the join token.  Misconfigurations that may allow the machine configuration to be accessed on a worker node by the Kubernetes workload are:allowing a `hostPath` mount to mount the machine config directly from the host filesystem (`hostPath` mounts should not be allowed for untrusted workloads, and are disabled by default in recent versions of Talos.)reading machine configuration from a cloud metadata server from Kubernetes pods with host networking (on cloud platforms, when machine config is stored in the cloud metadata server, and the cloud metadata server doesn't provide enough protection to prevent access from non-host workloads)PatchesThe problem was fixed in Talos 1.2.2.WorkaroundsEnabling the [Pod Security Standards](https://www.talos.dev/v1.2/kubernetes-guides/configuration/pod-security/)  mitigates the vulnerability by denying `hostPath` mounts and host networking by default in the [baseline](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) policy. Talos enables Pod Security Admission plugin by default since [Talos v1.1.0](https://www.talos.dev/v1.1/introduction/what-is-new/#pod-security-admission).Clusters that don't run untrusted workloads are not affected.
Clusters with correct Pod Security configurations which don't allow `hostPath` mounts, and secure access to cloud metadata server (or machine configuration is not supplied via cloud metadata server) are not affected.References[Talos v1.2.2 release](https://github.com/siderolabs/talos/releases/tag/v1.2.2)[Fixing commit](https://github.com/siderolabs/talos/commit/9eaf33f3f274e746ca1b442c0a1a0dae0cec088f)For more informationIf you have any questions or comments about this advisory:Email us at [security@siderolabs.com](mailto:security@siderolabs.com)
CVSS v3.1: 7.2
CVE-2025-13316: Hard-coded encryption keys in Twonky Server
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server.
CVSS v4.0: 8.2
GHSA-4hgv-m59w-35vw: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, and R9000 before 1.0.4.26.
CVE-2010-4265: The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch.  NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
CVSS v2.0: 2.6