ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-mmq8-m72q-qgm4: DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.
CVSS v3.0: 7.3
GHSA-2gmh-429f-mh43: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 6.5
GHSA-gjph-m3rc-hxq6: The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.
GHSA-r3vq-3892-g6rc: A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and ION9000 (All versions prior to V3.0.0), which could cause the meter to reboot or allow for remote code execution.
GHSA-x773-f7wv-p2hw: The Transaction Language 1 (TL1) login interface in Cisco ONS 15327 4.6(0) and 4.6(1) and 15454 and 15454 SDH 4.6(0) and 4.6(1), when a user account is configured with a blank password, allows remote attackers to gain unauthorized access by logging in with a password larger than 10 characters.
CVE-2006-5195: Multiple cross-site scripting (XSS) vulnerabilities in Wheatblog 1.0 and 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2022-2039: Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting
The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS v3.1: 8.8
CVE-2015-9428: The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2022-35804: SMB Client and Server Remote Code Execution Vulnerability
SMB Client and Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-7v45-rjcp-mf24: Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, and `display` parameters of the `admin.php` file.
CVSS v3.0: 6.1
CVE-2016-1367: The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug ID CSCus23248.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-w62w-hwrh-8fpp: Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings.
GHSA-269m-c36j-r834: Infinispan vulnerable to Insertion of Sensitive Information into Log File
A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.
CVSS v3.1: 5.5
CVE-2021-43512: An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-38q3-97f6-wg52: In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.
CVSS v3.1: 5.4
GHSA-g4x6-vrjg-m8w6: In the Linux kernel, the following vulnerability has been resolved:drm/amd: Fix an out of bounds error in BIOS parserThe array is hardcoded to 8 in atomfirmware.h, but firmware provides
a bigger one sometimes. Deferencing the larger array causes an out
of bounds error.commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error
in bios parser") fixed some of this, but there are two other cases
not covered by it.  Fix those as well.
CVE-2025-13628: Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.
CVSS v3.1: 4.3
GHSA-2j9p-vq42-gfv7: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser
CVSS v3.1: 6.1
GHSA-4rq4-pxv8-v7cg: The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.
RHSA-2009:1181: Red Hat Security Advisory: bind security and bug fix update
bind: DoS (assertion failure) via nsupdate packets
GHSA-vg95-jfx5-wh3m: In the Linux kernel, the following vulnerability has been resolved:ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_putThe correct helper to use in rt1011_recv_spk_mode_put() to retrieve the
DAPM context is snd_soc_component_to_dapm(), from kcontrol we will
receive NULL pointer.
CVSS v3.1: 5.5
CVE-2024-44997: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.

Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.

Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().

----------
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
 mtk_wed_setup_tc_block_cb+0x4/0x38
 0xffffffc0794084bc
 tcf_block_playback_offloads+0x70/0x1e8
 tcf_block_unbind+0x6c/0xc8
...
---------
CVSS v3.1: 7.8
CVE-2024-1149: Improper validation of update packages
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.


CVSS v3.1: 7.8
CVE-2018-6304: Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-4cpv-669c-r79x: Prevent injection of invalid entity ids for "autocomplete" fields
ImpactUnder certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices.Affected applications are any that use:A custom `query_builder` option to limit the valid results;
ANDAn `EntityType` with `'autocomplete' => true` or a custom [AsEntityAutocompleteField](https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax).Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with `query_builder`.PatchesThe problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.WorkaroundsUpgrade to version 2.11.2 or greater of `symfony/ux-autocomplete` or perform extra validation after submit to verify the selected option is valid.
CVSS v3.1: 6.5
CVE-2026-5859: Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1: 8.8
CVE-2020-15170: Missing access control in apollo-adminservice
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.
CVSS v3.1: 7
CVE-2025-8943: Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
CVSS v3.1: 9.8
CVE-2016-9650: Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
RHSA-2023:3433: Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: an out-of-bounds read when processing malicious content webkitgtk: a use-after-free when processing maliciously crafted web content
CVSS v3.1: 8.8
CVE-2017-18887: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-53q9-538q-rmmw: Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse.This issue affects Web Fax: from 3.0 before 4.0.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
GHSA-m35g-p77j-hqrh: Tenda G300-F router firmware versio 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
GHSA-5pm9-4rcq-46xg: CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a department via a crafted request.
CVSS v3.1: 4.3
GHSA-424p-2fvv-chq4: The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
CVSS v3.1: 7.5
GHSA-rwf5-4mqx-9qx5: Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
GHSA-q3h9-349m-77jh: Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
RHSA-2024:6054: Red Hat Security Advisory: ACS 4.4 enhancement and security update
containers/image: digest type does not guarantee valid type go-retryablehttp: url might write sensitive information to log file gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization
CVSS v3.1: 7.5
GHSA-9mrg-xwfh-j524: In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized.
CVSS v3.1: 7.8
RHSA-2023:0594: Red Hat Security Advisory: libksba security update
libksba: integer overflow to code execution
CVSS v3.1: 8.6
GHSA-5mxv-j9vc-66x9: PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.
CVSS v3.1: 6.5
CVE-2019-19077: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
GHSA-p345-jvp6-5qrj: Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130
GHSA-6qj8-69gc-hqf2: D-Link DIR-3040 prog.cgi SetWanSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21619.
CVSS v3.0: 6.8
CVE-2004-0520: Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php.
CVSS v2.0: 6.8
GHSA-qj5j-j4vg-43h6: A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2010-0040: Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.
CVSS v2.0: 9.3
CVE-2025-1331: IBM CICS TX code execution
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.
CVSS v3.1: 7.8
CVE-2017-9572: The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-vvqc-xqxj-mg66: eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.
CVSS v3.1: 7.5
GHSA-2w43-x8gp-rmvc: Vulnerability in the Hyperion Planning product of Oracle Hyperion (component: Application Development Framework). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Hyperion Planning accessible data. CVSS 3.1 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).
GHSA-7vrw-769q-3c2v: The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1: 6.5
GHSA-cvw6-gfvv-953q: Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
SummaryThe Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace` and `spec.configmaps[].namespace` equalled the function's own namespace but performed no equivalent check on
`spec.environment.namespace`.DetailsAn attacker with permission to create Functions in their own namespace could set `spec.environment.namespace` to any other tenant's namespace. poolmgr and newdeploy would then look up and use the victim's Environment CRD when scheduling
function pods, so the attacker's function executed inside the victim's container image.This is useful both for code and credential theft — the victim's runtime image may contain hardcoded secrets — and for confused-deputy attacks where the victim's runtime image is a privileged sidecar.ImpactA tenant with `functions.fission.io/create` could run their own function code inside another tenant's container image, breaking the namespace trust boundary that the Function specification implies.FixFixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).**Admission webhook** (`pkg/webhook/function.go::Validate`) rejects `Function.spec.environment.namespace != metadata.namespace`. An empty namespace remains accepted (the CLI defaults it to the function's namespace).**Controller belt-and-braces:** the same check runs before the cross-namespace `Environments(...).Get` in poolmgr `getFunctionEnv` and newdeploy `fnCreate` / `RefreshFuncPods`, covering webhook-bypass clusters (`failurePolicy=Ignore`)
and stale Function objects from upgrade-before-restart windows.Behavioural changeFunctions that explicitly set `spec.environment.namespace` to a different namespace are now rejected at admission. Empty-string remains accepted.
CVSS v3.1: 8.5
GHSA-vh97-rcg9-wfrw: Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
GHSA-h8rm-f377-9c5v: In the Linux kernel, the following vulnerability has been resolved:riscv, bpf: Fix potential NULL dereferenceThe bpf_jit_binary_free() function requires a non-NULL argument. When
the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps,
jit_data->header will be NULL, which triggers a NULL
dereference. Avoid this by checking the argument, prior calling the
function.
CVSS v3.1: 7.5
CVE-2018-9447: In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-v6v7-m3w9-36g8: Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
CVSS v4.0: 9.4
CVE-2021-41043: Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2007-2686: Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task.
CVSS v2.0: 4.3
CVE-2018-11221: Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2019-15258: Cisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.
CVSS v3.0: 6.5
GHSA-w2jp-m4xr-vgr3: Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non admin user could exploit this vulnerability and gain access to restricted resources.
CVSS v3.1: 6.5
GHSA-c3h4-65wr-9pqr: Cross-Site Request Forgery (CSRF) vulnerability in FS-code FS Poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through 6.5.8.
CVSS v3.1: 4.3
GHSA-7x76-6536-qg4c: An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
CVSS v3.1: 5.4
GHSA-9v76-xcm4-wwhw: Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
CVSS v3.1: 9.1
CVE-2006-6949: Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to obtain sensitive information by reading this file.
CVSS v2.0: 4.6