ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-cgqm-vxrq-vp47: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
CVSS v3.1: 7.2
CVE-2015-0523: EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allow remote attackers to cause an Administration Server denial of service via an invalid MIME e-mail message with a multipart/* Content-Type header.
CVSS v2.0: 7.8
CVE-2014-1558: Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559.
CVSS v2.0: 4.3
GHSA-xhjg-5g5x-rccw: Untrusted search path in the installer for Zoom Rooms before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVSS v3.1: 8.2
GHSA-xfwf-8q7p-hwxg: In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.
CVSS v3.1: 7
GHSA-2xh5-xw95-xh7p: A vulnerability was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cgi-bin/p1_ftpserver.php. The manipulation of the argument adr_txt leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2019-15319: The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2024-1284: Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 9.8
GHSA-vvqg-86qw-rhm8: A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
CVE-2020-0039: In rw_i93_sm_update_ndef of rw_i93.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143155861
CVSS v3.1: 7.5
CVSS v2.0: 7.8
CVE-2023-42431: Potential XSS on user preferences page
Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
CVSS v3.1: 2.1
CVE-2022-25170: ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
CVSS v3.1: 7.8
GHSA-f2r6-p94g-v5c4: The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.
CVSS v3.1: 6.5
GHSA-mrf4-89gh-pm62: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0.
CVSS v3.1: 8.8
GHSA-hwx8-q9cg-mqmc: Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
ImpactThe file metadata endpoint (GET `/files/:appId/metadata/:filename`) does not enforce `beforeFind` / `afterFind` file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.This affects any deployment that relies on `Parse.Cloud.beforeFind(Parse.File, ...)` to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.PatchesThe metadata handler now runs `beforeFind` and `afterFind` triggers and returns HTTP 403 when a trigger denies access.WorkaroundsDisable the `metadata` endpoint by overriding the route with a middleware that rejects all requests:Adjust the path prefix (`/parse`) to match your mountPath.ReferencesGitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmcFix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.9Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.9
CVSS v4.0: 6.3
RHSA-2025:7049: Red Hat Security Advisory: python-requests security update
requests: subsequent requests to the same host ignore cert verification
CVSS v3.1: 5.6
CVE-2016-3125: The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-27p7-fq6v-hh4m: A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.
CVSS v4.0: 2.3
CVSS v3.1: 4.2
GHSA-8jr7-qfgf-2wrq: A  Potential Command Injection vulnerability in HCL AION.An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0
CVSS v3.1: 4.5
GHSA-25pj-2jwp-wwwf: IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199167.
GHSA-pfx7-5p56-fqfv: SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.1: 7.6
CVE-2023-36474: Interactsh server settings make users vulnerable to Subdomain Takeover
Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.
CVSS v3.1: 8.2
RHSA-2022:7144: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update
zlib: A flaw found in zlib when compressing (not decompressing) certain inputs httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: NULL pointer dereference via crafted request during HTTP/2 request processing httpd: possible NULL dereference or SSRF in forward proxy configurations expat: Large number of prefixed XML attributes on a single tag can crash libexpat expat: Integer overflow in doProlog in xmlparse.c expat: Integer overflow in addBinding in xmlparse.c expat: Integer overflow in build_model in xmlparse.c expat: Integer overflow in defineAttribute in xmlparse.c expat: Integer overflow in lookup in xmlparse.c expat: Integer overflow in nextScaffoldPart in xmlparse.c expat: Integer overflow in storeAtts in xmlparse.c expat: Integer overflow in function XML_GetBuffer expat: integer overflow in the doProlog function expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution expat: Stack exhaustion in doctype parsing expat: Integer overflow in copyString() expat: Integer overflow in storeRawNames()
CVSS v3.1: 9.8
CVE-2020-25776: Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on the system to escalate their privileges. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2021-39153: XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS v3.1: 8.5
RHSA-2024:2962: Red Hat Security Advisory: virt:rhel and virt-devel:rhel security and enhancement update
QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service QEMU: improper IDE controller reset can lead to MBR overwrite QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx()
CVSS v3.1: 4.9
CVE-2022-37307: OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
CVSS v3.1: 6.1
GHSA-25mq-v84q-4j7r: CURLOPT_HTTPAUTH option not cleared on change of origin
Impact`Authorization` headers on requests are sensitive information. When using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin, if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` and `CURLOPT_USERPWD` options before continuing, stopping curl from appending the `Authorization` header to the new request. Previously, we would only consider a change in host. Now, we consider any change in host, port or scheme to be a change in origin.PatchesAffected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port.WorkaroundsIf you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle stream handler backend, rather than curl.References[RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)[CVE-2022-27776](https://curl.se/docs/CVE-2022-27776.html)For more informationIf you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).
CVSS v3.1: 7.7
GHSA-hqg9-gjhg-w3qg: Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
CVSS v3.0: 7.5
GHSA-8fh7-7jhg-rhr5: The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
CVSS v3.1: 6.1
CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path
Issue summary: When an application drives an AES-OCB context through the
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the
same effective nonce regardless of the IV supplied by the caller,
resulting in (key, nonce) reuse and loss of confidentiality.  If the
same code path is used to compute the authentication tag, the tag
depends only on the (key, IV) pair and not on the plaintext or
ciphertext, allowing universal forgery of arbitrary ciphertext from a
single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming
interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level
one-shot, EVP_Cipher(), whose documentation explicitly recommends
against use by applications in favour of EVP_CipherUpdate() and
EVP_CipherFinal_ex().  The OCB provider's streaming handler flushes
the application-supplied IV into the OCB context before processing
data; the one-shot handler did not.  Every call to EVP_Cipher() on an
AES-OCB context therefore ran with the all-zero key-derived offset
state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the
authentication tag, the deferred IV setup runs at that point and
clears the running checksum that should have been accumulated over the
plaintext.  The resulting tag is a function of (key, IV) only and
verifies against any ciphertext produced under the same (key, IV)
pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a
TLS cipher suite, and libssl does not call EVP_Cipher() in any case.
Applications that drive AES-OCB through the documented streaming AEAD
API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected.  Only
applications that combine the AES-OCB cipher with the EVP_Cipher()
one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.
CVSS v3.1: 7.5
GHSA-86r6-3wmr-wv39: Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.
GHSA-h5ph-3xr2-6x47: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12720.
CVSS v3.1: 7.8
CVE-2024-38284: Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
CVSS v4.0: 8.7
RHSA-2025:10701: Red Hat Security Advisory: kernel security update
kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: usb: config: fix iteration issue in &#39;usb_get_bos_descriptor()&#39; kernel: atl1c: Work around the DMA RX overflow issue kernel: HID: i2c-hid-of: fix NULL-deref on failed power up kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver&#39;s default device attribute group kernel: ext4: fix corruption during on-line resize kernel: usb: typec: ucsi: Limit read size on v1.2 kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage kernel: pinctrl: core: delete incorrect free in pinctrl_enable() kernel: drm/amdgpu: add error handle to avoid out-of-bounds kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind() kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning kernel: ELF: fix kernel.randomize_va_space double read kernel: xsk: fix OOB map writes when deleting elements kernel: md: fix mddev uaf while iterating all_mddevs list
CVSS v3.1: 7
GHSA-jgv4-w58m-q2g2: Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
CVE-2024-7762: Simple Job Board < 2.12.6 - Unauthenticated Resumes Download
The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes
CVSS v3.1: 3.7
CVE-2014-0767: Advantech WebAccess Stack-based Buffer Overflow
An attacker may exploit this vulnerability by passing an overly long 
value from the AccessCode argument to the control. This will overflow 
the static stack buffer. The attacker may then execute code on the 
target device remotely.
CVSS v2.0: 7.5
GHSA-6fh8-xrqr-xxqm: Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard allows Stored XSS. This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through 0.0.22.
CVSS v3.1: 7.1
GHSA-5v9m-7339-p4xv: Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS v3.1: 5.5
GHSA-3vxm-4f9v-fq2c: Integer signedness error in dirapi.dll in Adobe Shockwave Player before 11.5.7.609 and Adobe Director before 11.5.7.609 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir file that triggers an invalid read operation.
CVE-2003-0895: Buffer overflow in the Mac OS X kernel 10.2.8 and earlier allows local users, and possibly remote attackers, to cause a denial of service (crash), access portions of memory, and possibly execute arbitrary code via a long command line argument (argv[]).
CVSS v2.0: 4.6
CVE-2013-2338: Unspecified vulnerability on HP Integrated Lights-Out 3 (aka iLO3) cards with firmware before 1.57 and 4 (aka iLO4) cards with firmware before 1.22, when Single-Sign-On (SSO) is used, allows remote attackers to execute arbitrary code via unknown vectors.
CVSS v2.0: 10
GHSA-338x-j9c9-2c8v: This issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
CVSS v3.1: 9.8
GHSA-f28v-9jxw-wrc9: libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:425:14.
CVSS v3.0: 7.5
CVE-2016-10460: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 835, SD 845, and SD 850, vendor specific opcodes may not have any packet length validation leading to buffer over-reads.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2026-29146: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
CVSS v3.1: 7.5
CVE-2024-51825: WordPress Alert Me! plugin <= 0.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crissoca Alert Me! alert-me allows DOM-Based XSS.This issue affects Alert Me!: from n/a through <= 0.4.0.
CVSS v3.1: 6.5
CVE-2023-37336: Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20392.
CVSS v3.0: 7.8
CVE-2024-4580: Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35702 is likely a duplicate of this issue.
CVSS v3.1: 6.4
CVE-2019-9034: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for a memcpy in the function ReadNextCell() in mat5.c.
CVSS v3.0: 9.1
CVSS v2.0: 6.4