ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-26737: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

The following race is possible between bpf_timer_cancel_and_free
and bpf_timer_cancel. It will lead a UAF on the timer->timer.

bpf_timer_cancel();
	spin_lock();
	t = timer->time;
	spin_unlock();

					bpf_timer_cancel_and_free();
						spin_lock();
						t = timer->timer;
						timer->timer = NULL;
						spin_unlock();
						hrtimer_cancel(&t->timer);
						kfree(t);

	/* UAF on t */
	hrtimer_cancel(&t->timer);

In bpf_timer_cancel_and_free, this patch frees the timer->timer
after a rcu grace period. This requires a rcu_head addition
to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init,
this does not need a kfree_rcu because it is still under the
spin_lock and timer->timer has not been visible by others yet.

In bpf_timer_cancel, rcu_read_lock() is added because this helper
can be used in a non rcu critical section context (e.g. from
a sleepable bpf prog). Other timer->timer usages in helpers.c
have been audited, bpf_timer_cancel() is the only place where
timer->timer is used outside of the spin_lock.

Another solution considered is to mark a t->flag in bpf_timer_cancel
and clear it after hrtimer_cancel() is done.  In bpf_timer_cancel_and_free,
it busy waits for the flag to be cleared before kfree(t). This patch
goes with a straight forward solution and frees timer->timer after
a rcu grace period.
CVSS v3.1: 5.5
GHSA-fmw4-xvm4-wcm8: Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.
CVSS v3.1: 7.3
GHSA-mmh6-2vw6-82r4: A buffer overflow exists in the HELO command in Trend Micro Interscan VirusWall SMTP gateway 3.23/3.3 for NT, which may allow an attacker to execute arbitrary code.
CVE-2010-0300: cache.c in ircd-ratbox before 2.2.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a HELP command.
CVSS v2.0: 5
GHSA-7h8w-hj9j-8rjw: OpenHands is Vulnerable to Command Injection through its Git Diff Handler
SummaryA Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels.DetailsVulnerable Code PathThe vulnerability flows through these files:**API Endpoint** (`openhands/server/routes/files.py:267-277`)**Runtime** (`openhands/runtime/base.py:1231-1233`)**Vulnerable Method** (`openhands/runtime/utils/git_handler.py:10-12, 134`)**Shell Execution** (`openhands/runtime/utils/git_diff.py:25-27`)Root CauseThe `file_path` parameter is directly interpolated into a shell command string using Python's `.format()` method without any sanitization. When this command is executed with `shell=True`, shell metacharacters like `"`, `;`, and `#` are interpreted, allowing command injection.**Example:**Input: `test"; id #`Constructed command: `python3 /script.py "test"; id #"`Shell interprets as two commands: `python3 /script.py "test"` AND `id`ImpactWho is AffectedAll OpenHands deployments exposing the `/api/conversations/{id}/git/diff` endpointAny authenticated user can exploit this vulnerability,Attack CapabilitiesAn attacker can:**Execute arbitrary commands** on the runtime container as root**Read sensitive files** including `.env`, API keys, source code**Write arbitrary files** to inject malicious code**Establish reverse shells** for persistent access**Potentially escape the container** if Docker is misconfiguredMitigationUsers should update to the latest version of OpenHands that includes the changes from PR #13051. The fix replaces direct shell string formatting with proper argument array handling or rigorous path sanitization to prevent command chaining.
CVSS v3.1: 7.6
GHSA-wx3h-mcq4-xc2r: The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.
CVSS v3.1: 9.8
GHSA-h76m-ch4c-5r4x: Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.8
GHSA-qfxw-gf23-4xf5: A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is an unknown function of the file login.php of the component User Registration. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225342 is the identifier assigned to this vulnerability.
CVSS v3.1: 9.8
GHSA-xp4c-5vw7-4hvv: Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie composed of a Sorenson 3 video file.
CVE-2023-38082: Kofax Power PDF GIF File Parsing Memory Corruption Remote Code Execution Vulnerability
Kofax Power PDF GIF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20488.
CVSS v3.0: 7.8
CVE-2020-1729: A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
CVSS v3.1: 4.4
CVSS v2.0: 2.1
GHSA-5vjf-7425-428p: Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter.  NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
GHSA-72mj-584j-5c85: Insufficient input validation in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to cause a denial of service via local access.
CVSS v3.0: 6.5
GHSA-99m9-pgm3-57w3: H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.
CVSS v3.1: 9.8
CVE-2017-9947: A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2018-5805: A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-8g65-2hpp-8gjf: An arbitrary file upload vulnerability has been discovered in ROS2 Iron Irwini versions ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code via a crafted payload to the file upload mechanism of the ROS2 system, including the server’s functionality for handling file uploads and the associated validation processes.
GHSA-xj8x-rm7w-xfh4: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-gg47-6mxg-9jcv: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
CVSS v3.1: 9.6
GHSA-777v-j39v-h8x4: Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
GHSA-2mc4-f3f5-xmwp: A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.
CVSS v3.0: 4.3
CVE-2017-4907: VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2016-1027: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-v647-rh6c-m9fr: A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.3
CVSS v3.1: 7.2
GHSA-hjxq-w2ww-jfj3: A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox < 125.
CVSS v3.1: 8.8
GHSA-q4wm-8j25-33f7: PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
CVSS v3.0: 9.8
GHSA-ch75-4hc2-84c6: Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search.
CVSS v3.1: 6.1
CVE-2006-6728: Unspecified vulnerability in the info request mechanism in LAN Messenger before 1.5.1.2 allows remote attackers to cause a denial of service (application crash) or transmit spam via unspecified vectors.
CVSS v2.0: 6.4
GHSA-2cj8-cg4w-q64p: Windows Kernel Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-x525-xmpm-prq9: The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.
CVSS v3.1: 7.5
GHSA-h7vr-cg25-jf8c: StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
SummaryThe POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system.DetailsVulnerable Code**File:** packages/studiocms/frontend/pages/studiocms_api/dashboard/create-reset-link.ts
**Version:** studiocms@0.3.0AnalysisUnlike the API token endpoints (which only require isEditor), this handler correctly gates access at the isAdmin level [1]. However, two critical authorization checks are still missing:**No caller identity validation [2][3]:** The userId from the JSON payload is never compared against the authenticated caller's session identity. An admin can specify any user's UUID, including the owner's.**No role hierarchy enforcement [4]:** The handler does not verify whether the target user has a higher privilege level than the caller. An admin can target the owner account, which is the only account that should be immune to administrative actions from lower-ranked admins.**Reset token returned in response [5]:** The generated reset token (a signed JWT) is returned directly in the HTTP response body. This token can then be used with the reset-password endpoint to set an arbitrary password for the target account, completing the account takeover chain.The core issue is that password reset generation is treated as a generic admin operation rather than a self-service operation with explicit scope restrictions.PoC**Environment**
*User ID | Role*
2450bf33-0135-4142-80be-9854f9a5e9f1 | owner
eacee42e-ae7e-4e9e-945b-68e26696ece4 | admin**Step 1 — Verify Attacker's Session (Admin)**
Confirm the attacker is authenticated as admin (user dummy03):Response:**Step 2 — Generate Password Reset Token for the Owner**
The admin sends a request to create a reset link targeting the owner's UUID:Response:The server generated a valid password reset JWT for the owner account and returned it to the admin caller.**Step 3 — Reset the Owner's Password**
Using all three values from the previous response (id, userId, token), the attacker sets a new password for the owner:Response:The owner's password has been changed. The admin can now log in as the owner with the new credentials, gaining full control of the StudioCMS instance.Impact**Owner Account Takeover:** Any admin can change the owner's password and assume full control of the StudioCMS instance, including all content, user management, and system configuration.
CVSS v3.1: 6.8
CVE-2025-31916: WordPress JP Students Result Management System Premium plugin 1.1.7 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.
CVSS v3.1: 9
GHSA-q4q3-596j-p268: An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is overflowed with the call to sprintf() for any ip values that are greater than 1024-len(‘/etc/config-tools/config_interfaces interface=X1 state=enabled ip-address=‘) in length. A ip value of length 0x3da will cause the service to crash.
CVE-2017-11525: The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS v3.0: 6.5
CVSS v2.0: 7.1
GHSA-p329-qr4h-9548: Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
GHSA-vrgx-7r4m-fqpg: admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service (loss of configuration data), and possibly perform direct static code injection, via a saveGlobalconfig action.
GHSA-3gxw-m9pv-89hq: Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windows 10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2014-3411: Unspecified vulnerability in the NSM XDB service in Juniper NSM before 2012.2R8 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0: 10
CVE-2020-6020: Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator.
CVSS v3.1: 6.4
CVSS v2.0: 7.4
RHSA-2018:3505: Red Hat Security Advisory: Red Hat Ansible Tower 3.3.1-2 Release - Container Image
Security Advisory
GHSA-8f38-4m5j-j72v: Stack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arbitrary code via a long ShowPreferences argument.
RHEA-2024:1366: Red Hat Enhancement Advisory: Red Hat Developer Hub 1.1 release
follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) nodejs-ip: arbitrary code execution via the isPublic() function HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) node-undici: cookie leakage css-tools: regular expression denial of service (ReDoS) when parsing CSS octopost/webhooks: uncaught exception
CVSS v3.1: 7.5
CVE-2025-39590: WordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.
CVSS v3.1: 6.5
GHSA-7fpf-mqr5-8pc2: The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
CVE-1999-0300: nis_cachemgr for Solaris NIS+ allows attackers to add malicious NIS+ servers.
CVSS v2.0: 7.5
GHSA-5w3g-jx63-m47q: Multiple cross-site scripting (XSS) vulnerabilities in cl_files/index.php in SoftComplex PHP Event Calendar 1.5.1, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) ti, (2) bi, or (3) cbgi parameters.
GHSA-9vvh-9hhr-7gvr: Adobe Bridge versions 13.0.4 (and earlier) and 14.0.0 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 3.3
CVE-2017-15124: VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-9p5j-mqg2-g6gp: Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).
CVSS v3.0: 8.2
CVE-2020-29379: An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-qq7c-vp73-p9c7: FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
CVE-2022-21256: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-65x8-8358-vgrj: CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.
CVSS v4.0: 7.5
CVE-2022-31529: The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS v3.1: 9.3
CVSS v2.0: 6.4
GHSA-m5q3-x5vg-97f9: A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
CVE-2021-25322: python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root
A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1.
CVSS v3.1: 6.8