ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-24910: LocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system.
CVSS v3.1: 7.3
GHSA-4mw3-j4r4-8fq9: The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.
CVSS v3.1: 9.8
GHSA-jpgw-2r9m-8qfw: Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
ImpactKiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced
changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly!The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed.Additionally file upload validators and parts of the HTML rendering code have been found to require additional sanitation and improvements.PatchesUpdated Nginx content type configurationImproved file upload validation code to prevent more potentially dangerous uploadsSanitization of test plan names used in the `tree_view_html()` functionReferencesDisclosed by [M Nadeem Qazi](https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8/) and
[Mahshooq Zubair](https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223/).
CVSS v3.1: 8.1
GHSA-5w72-jwxr-3wp7: The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-8qpj-mfhj-m8h3: Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sensitive information.
CVSS v3.1: 5.1
CVE-2024-57771: A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS v3.1: 4.8
GHSA-4w4h-8qh9-342x: Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
CVSS v4.0: 2.3
CVE-2024-24746: Apache NimBLE: Denial of service in NimBLE Bluetooth stack
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. 

Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device.

This issue affects Apache NimBLE: through 1.6.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS v3.1: 7.5
CVE-2012-5843: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS v2.0: 9.3
CVE-2020-28397: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2020-11044: Double Free in FreeRDP
In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
CVSS v3.1: 2.2
CVE-2010-0930: The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (infinite loop) via crafted data that includes a byte sequence of 0xdc, 0xff, 0xff, and 0xff immediately before the client protocol version number.
CVSS v2.0: 5
GHSA-qxx8-22p6-c299: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information
CVSS v3.1: 9.8
GHSA-572x-vhpq-w4gm: Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151.
CVSS v3.1: 7.5
CVE-2014-6261: Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session, aka ZEN-12657.
CVSS v2.0: 9.3
GHSA-wwwx-88mv-pg56: qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
CVSS v3.1: 5.3
CVE-2021-1070: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an unprivileged user being able to modify system device tree files, leading to denial of service.
CVSS v3.1: 7.1
RHSA-2017:3260: Red Hat Security Advisory: samba security update
samba: Use-after-free in processing SMB1 requests samba: Server heap-memory disclosure
CVSS v3.0: 4.3
CVE-2018-20508: CrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search() function.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2020-13757: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-43379: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()

opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being
accessed after rcu_read_unlock() has been called. This creates a
race condition where the memory could be freed by a concurrent
writer between the unlock and the subsequent pointer dereferences
(opinfo->is_lease, etc.), leading to a use-after-free.
CVSS v3.1: 9.8
CVE-2019-16910: Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
CVSS v3.1: 5.3
CVSS v2.0: 2.6
RHSA-2019:0640: Red Hat Security Advisory: java-1.8.0-ibm security update
libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() JDK: missing null check when accelerating Unsafe calls OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) JDK: unspecified vulnerability fixed in 8u201 (Deployment)
CVSS v3.0: 3.1
CVE-2020-9207: There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers can exploit this vulnerability by crafting malicious files to bypass current verification mechanism. This can compromise normal service.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2020-9306: Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
CVSS v3.1: 8.8
CVE-2025-21435: Buffer Over-read in WLAN Host Communication
Transient DOS may occur while parsing extended IE in beacon.
CVSS v3.1: 7.5
ICSA-19-017-02: ABB CP400 Panel Builder TextEditor 2.0
The application contains a vulnerability in the file parser of the Text Editor wherein the application doesn 't properly prevent the insertion of specially crafted files.CVE-2018-19008 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.0: 7
CVE-2026-34672: CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS v3.1: 6.2
RHSA-2024:1210: Red Hat Security Advisory: OpenShift Container Platform 4.15.2 bug fix and security update
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
CVSS v3.1: 5.9
CVE-2018-11162: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2018-21009: Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-55fh-chpw-5q5r: Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors.
CVSS v3.0: 8.8
CVE-2015-7398: Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2009-0982: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote authenticated users to affect integrity via unknown vectors.
CVSS v2.0: 4
CVE-2013-3579: The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.lookout.security.ScanTell with zero arguments.
CVSS v2.0: 4.3
GHSA-64jx-9wjf-vr92: An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox.
CVSS v3.1: 7.8
GHSA-ggrj-hrpf-2qjw: Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.
CVSS v3.1: 8.8
GHSA-2mh2-9xm5-m59q: In the Linux kernel, the following vulnerability has been resolved:bonding: change ipsec_lock from spin lock to mutexIn the cited commit, bond->ipsec_lock is added to protect ipsec_list,
hence xdo_dev_state_add and xdo_dev_state_delete are called inside
this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,
"scheduling while atomic" will be triggered when changing bond's
active slave.[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200
[  101.055726] Modules linked in:
[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1
[  101.058760] Hardware name:
[  101.059434] Call Trace:
[  101.059436]  <TASK>
[  101.060873]  dump_stack_lvl+0x51/0x60
[  101.061275]  __schedule_bug+0x4e/0x60
[  101.061682]  __schedule+0x612/0x7c0
[  101.062078]  ? __mod_timer+0x25c/0x370
[  101.062486]  schedule+0x25/0xd0
[  101.062845]  schedule_timeout+0x77/0xf0
[  101.063265]  ? asm_common_interrupt+0x22/0x40
[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10
[  101.064215]  __wait_for_common+0x87/0x190
[  101.064648]  ? usleep_range_state+0x90/0x90
[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]
[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]
[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]
[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]
[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]
[  101.067738]  ? kmalloc_trace+0x4d/0x350
[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]
[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]
[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]
[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]
[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]
[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]
[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]
[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]
[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0
[  101.073033]  vfs_write+0x2d8/0x400
[  101.073416]  ? alloc_fd+0x48/0x180
[  101.073798]  ksys_write+0x5f/0xe0
[  101.074175]  do_syscall_64+0x52/0x110
[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called
from bond_change_active_slave, which requires holding the RTNL lock.
And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state
xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user
context. So ipsec_lock doesn't have to be spin lock, change it to
mutex, and thus the above issue can be resolved.
CVSS v3.1: 5.5
CVE-2013-6648: SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash).
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-42019: A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication.
CVSS v3.0: 9
CVE-2017-13033: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-f6mm-2q2w-87fg: TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS v3.1: 5.4
GHSA-jh3p-chcw-4c58: Multiple cross-site scripting (XSS) vulnerabilities in NagiosQL 3.2 SP2 allow remote attackers to inject arbitrary web script or HTML via the txtSearch parameter to (1) admin/hostdependencies.php, (2) admin/hosts.php, or other unspecified pages that allow search input, related to the search functionality in functions/content_class.php.
GHSA-w22j-4p67-8rmf: SQL injection vulnerability in functions/global.php in Elemata CMS RC 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-0079: Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.
CVSS v2.0: 4.3
GHSA-36x8-w686-7p3g: Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse.This issue affects PhishPro: before 7.5.4.2.
CVSS v3.1: 8.8
GHSA-pjw6-3vww-974f: The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter.
CVE-2022-1328: Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line
CVSS v3.1: 4.3
CVE-2018-1355: An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature.  An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.
CVSS v3.0: 6.1
CVSS v2.0: 5.8
GHSA-qh65-8276-pjhm: Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Oracle Applications DBA executes to compromise Oracle Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications DBA accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications DBA. CVSS 3.0 Base Score 3.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).
CVSS v3.1: 3.9
CVE-2007-3026: Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length values to TCP ports 19226 or 19227, resulting in a heap-based buffer overflow.
CVSS v2.0: 9.3
CVE-2018-5205: When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2022-36075: File list exposure in Nextcloud Files Access Control
Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issue
CVSS v3.1: 2.6
CVE-2022-22738: Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS v3.1: 8.8
GHSA-hq5f-j5j2-j69g: A vulnerability classified as critical was found in Tenda F1203 2.0.1.6. This vulnerability affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258148. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
CVE-2026-54353: Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection later performs a separate DNS lookup through node-fetch. Since the validated IPs are never pinned to the connection, an attacker-controlled hostname can return a public IP during validation and a private/internal IP during the real connection. This results in a non-blind SSRF primitive against internal services reachable from the Budibase host, including loopback, RFC1918 ranges, and cloud metadata endpoints. This vulnerability is fixed in 3.39.9.
CVSS v3.1: 8.5
RHSA-2022:1420: Red Hat Security Advisory: OpenShift Container Platform 3.11.685 security and bug fix update
xstream: Injecting highly recursive collections or maps can cause a DoS workflow-cps: OS command execution through crafted SCM contents workflow-cps-global-lib: OS command execution through crafted SCM contents workflow-multibranch: OS command execution through crafted SCM contents workflow-cps: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps: Password parameters are included from the original build in replayed builds workflow-cps-global-lib: Sandbox bypass vulnerability workflow-cps-global-lib: Sandbox bypass vulnerability workflow-cps-global-lib: Sandbox bypass vulnerability pipeline-build-step: Password parameter default values exposed
CVSS v3.1: 6.5
GHSA-9fgc-v6c2-ff44: Information disclosure while reading data from an image using specified offset and size parameters.
CVSS v3.1: 6.5
GHSA-xr6g-86xc-gg67: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flector Easy Textillate allows Stored XSS.This issue affects Easy Textillate: from n/a through 2.02.
CVSS v3.1: 6.5
GHSA-9wmf-xf3h-r8pr: Jberet: jberet-core logging database credentials
A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.
CVSS v3.1: 6.5
CVE-2021-38688: Improper Authentication in Qfile
An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later
CVSS v3.1: 7.1
GHSA-rfc9-ch47-q4m3: Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries.  NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
CVE-2006-3786: Symantec pcAnywhere 12.5 uses weak integrity protection for .cif (aka caller or CallerID) files, which allows local users to generate a custom .cif file and modify the superuser flag.
CVSS v2.0: 3.6
CVE-2026-2698: Improper Access Control
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
CVSS v4.0: 5.7
CVSS v3.1: 6.5
GHSA-c9g5-h8rc-q6m5: An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in the 4.23.x train; 4.22.6M and below releases in the 4.22.x train.