ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-2r4c-p58r-h5gx: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
CVE-2020-13095: Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root.
CVSS v3.1: 8.8
CVSS v2.0: 9
GHSA-f4j4-c7rv-68cx: The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries.
CVSS v3.1: 5.3
CVE-2015-1194: pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
CVSS v2.0: 4.3
ICSA-24-214-03: Johnson Controls exacqVision Web Service
In Johnson Controls exacqVision Web Service versions 24.03 and prior, an attacker may be able to perform state-changing operations with administrative privileges.
CVSS v3.1: 6.8
GHSA-vg6g-2p3v-px29: Missing Authorization vulnerability in Stylemix MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.6.15.
CVSS v3.1: 6.5
GHSA-q2pq-wmhc-m7hv: An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).
CVSS v3.1: 7.5
CVE-2009-3883: Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657138.
CVSS v2.0: 7.5
GHSA-x69j-4m9q-984q: Unspecified vulnerability in Kerio MailServer before 6.0.3 has unknown impact and unknown remote attack vectors, related to a "potential security issue."
CVE-2023-28353: An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.
CVSS v3.1: 8.8
GHSA-gvqh-48v6-r4xm: The Intellivend shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
GHSA-c8rv-h68c-jvwr: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
CVSS v3.0: 9.8
CVE-2023-38333: Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
CVSS v3.1: 6.1
CVE-2024-30226: WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.
CVSS v3.1: 9
RHSA-2010:0521: Red Hat Security Advisory: gfs-kmod security update
kernel: bug in GFS/GFS2 locking code leads to dos
CVE-2024-3014: SourceCodester Simple Subscription Website Actions.php sql injection
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258300.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2000-0997: Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.
CVSS v2.0: 7.2
GHSA-prp6-7gc9-4jmw: rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
CVSS v3.1: 6.5
CVE-2025-55672: Apache Superset: Stored XSS on charts metadata
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
CVSS v4.0: 5.3
CVE-2018-10128: An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-9299: Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow
A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-hmw2-6mw6-9hgp: Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/db.mdb.
CVE-2005-2853: Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to printfaq.php, or the (2) Referer or (3) User-Agent HTTP headers, which are not properly handled by error.php.
CVSS v2.0: 4.3
CVE-2025-54215: InCopy | Out-of-bounds Write (CWE-787)
InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2002-2048: Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program, (2) -l, (3) -d, and (4) -t options.  NOTE: if PFinger is not setuid or setgid, then this issue would not cross privilege boundaries and would not be considered a vulnerability.
CVSS v2.0: 7.5
CVE-2025-6778: code-projects Food Distributor Site save_settings.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-95p9-9fgr-299p: Unspecified vulnerability in Oracle Application Server 9.0.4.3 and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related to Oracle Containers for J2EE, aka OC4J02.
RHSA-2023:3884: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 8
RHSSO: XSS due to lax URI scheme validation Undertow: Infinite loop in SslConduit during close keycloak: Untrusted Certificate Validation keycloak: oauth client impersonation keycloak: client access via device auth request spoof
CVSS v3.1: 3.5
CVE-2022-20151: Product: AndroidVersions: Android kernelAndroid ID: A-210712565References: N/A
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2019-4410: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657.
CVSS v3.0: 5.4
GHSA-2282-f329-v64x: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
GHSA-c753-x75x-629c: Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVSS v3.1: 7.9
GHSA-mjh6-vpjc-86w5: Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
CVSS v3.1: 7.5
CVE-2024-22080: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during XML body parsing.
CVSS v3.1: 9.8
CVE-2019-8166: Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a buffer overrun vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-grp5-2x24-q4vj: A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input
attackers can cause the software’s web application to redirect to the chosen domain after a
successful login is performed.
CVSS v3.1: 8.2
CVE-2008-6393: PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.
CVSS v2.0: 10
CVE-2019-3395: The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2026-24098: Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. 

Users are advised to upgrade to 3.1.7 or later, which resolves this issue
CVSS v3.1: 6.5
GHSA-3xjq-8j89-xrw9: Jenkins Badge Plugin cross-site scripting vulnerability
A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. Badge Plugin 1.5 and newer sanitizes the provided HTML for display on the Jenkins web UI.
CVSS v3.0: 5.4
CVE-2001-1510: Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
CVSS v2.0: 5
CVE-2024-34013: Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before build 41396, Acronis True Image OEM (macOS) before build 42571.
CVSS v3.0: 7.8
CVE-2025-1592: SourceCodester Best Employee Management System Add Role Page Role.php cross site scripting
A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/Operations/Role.php of the component Add Role Page. The manipulation of the argument assign_name/description leads to cross site scripting. The attack may be launched remotely.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-8p46-c7vp-cvj5: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7.
CVSS v3.1: 5.3
CVE-2018-10256: A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-cw6q-f999-4vr6: Trend Micro OfficeScan 5.5, and probably other versions before 6.5, uses insecure DACLs for critical files, which allows local users to gain SYSTEM privileges by modifying tmlisten.exe.
CVE-2006-1516: The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.
CVSS v2.0: 5
GHSA-pwjx-cx2h-hr2h: An unspecified ActiveX control in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 (Flash10h.ocx) on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FLV video.
CVE-2014-7551: The Noticias Bebes Beybies (aka com.beybies) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
RHSA-2022:8222: Red Hat Security Advisory: xorg-x11-server-Xwayland security update
xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension
CVSS v3.1: 7.8
CVE-2025-59348: Dragonfly incorrectly handles a task structure’s usedTraffic field
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.
CVSS v4.0: 5.5
CVE-2022-47456: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVSS v3.1: 5.5
GHSA-gqrr-x6f4-q53v: Unspecified vulnerability in the TIFF viewer (possibly libTIFF) in the Photo Viewer in the Sony PlaystationPortable (PSP) 2.00 through 2.80 allows local users to execute arbitrary code via crafted TIFF images. NOTE: due to lack of details, it is not clear whether this is related to other issues such as CVE-2006-3464 or CVE-2006-3465.
GHSA-r328-753q-m689: Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.
CVE-2018-14962: zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2021-22906: Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.
CVSS v3.1: 6.5
CVSS v2.0: 4
RHSA-2013:0656: Red Hat Security Advisory: krb5 security update
krb5: PKINIT null pointer deref leads to DoS krb5: PKINIT null pointer deref leads to DoS  (pkinit_check_kdc_pkid())
CVE-2025-7350: Rockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability
A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.
CVSS v4.0: 8.6
CVE-2023-3596: Rockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service 

Where this vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products, it could allow a malicious user to cause a denial of service by asserting the target system through maliciously crafted CIP messages.


CVSS v3.1: 7.5
GHSA-gw98-8mff-5x24: MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.
CVSS v3.1: 8.6
GHSA-j46x-wj3p-r6qg: SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.
CVSS v3.1: 7.2
CVE-2023-4066: Operator: passwords defined in secrets shown in statefulset yaml
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
CVSS v3.1: 5.5
GHSA-qx2c-cjfg-57c3: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVE-2024-5594: OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
CVSS v3.1: 9.1
CVE-2026-7264: SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2026-34758: OneUptime: Missing Authentication on Notification Endpoints
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.
CVSS v3.1: 9.1
CVE-2010-2245: XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document.
CVSS v3.0: 7.4
CVSS v2.0: 5.8
CVE-2023-36664: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVSS v3.1: 7.8
CVE-2013-2967: Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-jp7v-jpwq-p4pw: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pages, specifically in the UI logic that renders and handles the Active/Actions buttons. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-g3c2-cf4p-fhw2: In the Linux kernel, the following vulnerability has been resolved:wifi: libertas: Fix possible refcount leak in if_usb_probe()usb_get_dev will be called before lbs_get_firmware_async which means that
usb_put_dev need to be called when lbs_get_firmware_async fails.
CVSS v3.1: 5.5
GHSA-6pvw-5765-4xq4: TOTVS Fluig Luke 1.7.0 allows directory traversal via a base64 encoded file=../ to a volume/stream/ URI. This affects: Fluig Lake 1.7.0-210217, Fluig Lake 1.7.0-210112, Fluig Lake 1.7.0-201215, Fluig Lake 1.7.0-201124 and Fluig Lake 1.7.0-200915.
CVSS v3.1: 8.6
GHSA-4hhf-2jrm-j2h2: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
CVE-2008-0935: Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote attackers to execute arbitrary code via a long argument to the ExecuteRequest method.
CVSS v2.0: 10
CVE-2025-25254: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.
CVSS v3.1: 6.8
RHSA-2026:29795: Red Hat Security Advisory: OpenShift Container Platform 4.22.3 bug fix and security update
lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: URI authority bypass due to improper delimiter handling shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
CVSS v3.1: 7.1
CVE-2024-1531: A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random memory content in the RTU500 system log, if an authorized user uploads a specially crafted stb-language file.
CVSS v3.1: 8.2
PYSEC-2022-172: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.