ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-75mw-h36v-2jv7: Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
SummaryThe HTML and RSS output handlers in `dosagelib/events.py` write user-controlled content (comic text and page URLs) directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can execute in their browser.**CWE**: [CWE-79](https://cwe.mitre.org/data/definitions/79.html) - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)DetailsVulnerable Code LocationsThe vulnerability exists in `dosagelib/events.py` where untrusted content is written to HTML/RSS output without escaping:**1. RSSEventHandler (lines 116-118)****2. HtmlEventHandler (lines 232, 238)**Root Cause`BasicScraper.fetchText()` in `scraper.py:422` calls `html.unescape()` on extracted textThe output handlers never call `html.escape()` before writing to filesNo sanitization of URLs or text content occurs anywhere in the output pipelineData FlowPoCI created a proof-of-concept that demonstrates the vulnerability by simulating a malicious comic source.PrerequisitesDocker installed and runningPoC FilesCreate these files in a `poc/` directory:**1. `poc/Dockerfile`****2. `poc/poc.py`****3. `poc/run_poc.sh`**Running the PoCPoC OutputThe output shows that:The `javascript:` URL is written directly into `<a href>` attributesThe `<script>` tag from comic text appears unescaped in the HTML bodyImpactWho is affected?Users who use `dosage --output html` or `dosage --output rss` optionsAnyone who opens the generated HTML/RSS files in a browserAttack scenarioAttacker creates or compromises a webcomic siteAttacker injects JavaScript into image title/alt attributes:Victim runs: `dosage MaliciousComic --output html`The generated `Comics/html/comics-YYYYMMDD.html` contains the unescaped scriptWhen victim opens the file, JavaScript executesPotential consequences**Cookie theft** if files are served over HTTP**Local file access** via `file://` protocol**Phishing attacks** through DOM manipulationRecommended FixEscape all user-controlled content before writing to HTML/RSS:For URLs, validating that they use safe protocols (`http://`, `https://`) would also help prevent javascript: URLs.Resources[CWE-79: Cross-site Scripting (XSS)](https://cwe.mitre.org/data/definitions/79.html)[OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)[Python html.escape() documentation](https://docs.python.org/3/library/html.html#html.escape)
CVSS v3.1: 6.1
GHSA-6f75-x745-xcpr: Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
ImpactThe vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance  by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.PatchesPatched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
CVSS v3.1: 7.1
GHSA-cr5q-6q9f-rq6q: Active Support Possibly Discloses Locally Encrypted Files
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5ImpactActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.All users running an affected release should either upgrade or use one of the workarounds immediately.ReleasesThe fixed releases are available at the normal locations.WorkaroundsTo work around this issue, you can set your umask to be more restrictive like this:
CVSS v3.0: 5.5
GHSA-mjj4-vf2r-hmm2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through 45.10.0.
CVSS v3.1: 6.5
GHSA-8j9f-f493-r9mh: Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice commands, which allows physically proximate attackers to bypass the locked state via a command that forwards an active e-mail message to an arbitrary recipient.
CVE-2024-26593: i2c: i801: Fix block process call transactions
In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Fix block process call transactions

According to the Intel datasheets, software must reset the block
buffer index twice for block process call transactions: once before
writing the outgoing data to the buffer, and once again before
reading the incoming data from the buffer.

The driver is currently missing the second reset, causing the wrong
portion of the block buffer to be read.
CVSS v3.1: 7.1
GHSA-933w-hvw9-gc93: In Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering.
ICSA-17-045-02: Geutebrück IP Cameras
An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.CVE-2017-5174 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution.CVE-2017-5173 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 9.8
GHSA-vmw8-vh7h-pqf3: A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_product.php. Executing manipulation of the argument del_pro can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-pvf4-hr84-4g6r: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVSS v3.1: 5.5
CVE-2018-15313: On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2023-35929: Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps
Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. A malicious user with the capability to create an artifact or to edit a field used as a card field could force victim to execute uncontrolled code. Tuleap Community Edition 14.10.99.4, Tuleap Enterprise Edition 14.10-2, and Tuleap Enterprise Edition 14.9-5 contain a fix.
CVSS v3.1: 5.4
CVE-2026-35535: In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
CVSS v3.1: 7.4
CVE-2010-0291: The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service (panic) by calling the (1) mmap or (2) mremap function, aka the "do_mremap() mess" or "mremap/mmap mess."
CVSS v2.0: 4.6
CVE-2012-1660: Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.
CVSS v2.0: 2.1
CVE-2012-0048: OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service (game pause) by connecting to the server and not finishing the (1) authorization phase or (2) map download, aka a "slow read" attack.
CVSS v2.0: 4.3
GHSA-fm6m-fg23-67jq: Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.
CVSS v3.1: 5.4
CVE-2010-1081: Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS v2.0: 5
CVE-2026-5397: Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application
It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with administrator privileges.

If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product’s behavior of loading missing DLLs from the same directory as the executable during service startup.
CVSS v3.1: 7.8
CVE-2008-4612: Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp and (2) content.asp.
CVSS v2.0: 4.3
GHSA-rqx8-6cfx-pw7v: Cross-site scripting (XSS) vulnerability in coWiki 0.3.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter, as demonstrated using 26.html.
CVE-2006-0078: Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php.
CVSS v2.0: 4.3
GHSA-7ph4-rw5h-3cgg: An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
CVSS v3.1: 5.3
GHSA-wqvp-j9fj-j6wf: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /user_dashboard/donor.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
GHSA-f5r2-w3hx-hpw2: Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1635.
CVE-2023-37548: CODESYS: Improper Input Validation in CmpApp component
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550


CVSS v3.1: 6.5
CVE-2021-36950: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1: 5.4
RHSA-2011:1291: Red Hat Security Advisory: jakarta-commons-daemon-jsvc security update
jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser
CVE-2021-28807: Post-Authentication Reflected XSS Vulnerability in Q'center
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later
CVSS v3.1: 7.7
GHSA-47hw-p9qv-5wqq: Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 may allow an authenticated user to potentially enable Information disclosure via data exposure.
CVSS v4.0: 2
CVSS v3.1: 3.3
CVE-2022-1023: Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
CVSS v3.1: 7.2
CVSS v2.0: 6.5
ICSA-24-268-06: OMNTEC Proteus Tank Monitoring (Update A)
The affected product may allow an attacker to perform administrative actions without proper authentication.
CVSS v3.1: 9.8
ICSA-21-040-03: Siemens SINEMA Server & SINEC NMS
When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)
CVSS v3.1: 8.8
CVE-2019-5613: In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-qphc-hf5q-v8fc: actionpack Open Redirect in Host Authorization Middleware
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.ReleasesThe fixed releases are available at the normal locations.PatchesTo aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series7-0-host-authorzation-open-redirect.patch - Patch for 7.0 seriesPlease note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
CVSS v3.1: 6.1
CVE-2019-12150: Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-27xr-j3f5-jw66: An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL query.
CVSS v3.1: 7.5
CVE-2020-4912: IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
CVSS v3.0: 4.7
GHSA-8j6m-p4rm-wvhf: The dumpBuffer function in read.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SWF file.
CVSS v3.0: 5.5
GHSA-cmrm-j5wq-2rcr: Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
CVSS v3.0: 7.2
RHSA-2009:1096: Red Hat Security Advisory: seamonkey security update
Firefox browser engine crashes Firefox JavaScript engine crashes file: resources Firefox arbitrary code execution flaw Firefox JavaScript arbitrary code execution
GHSA-75pq-cv68-5rxq: Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
GHSA-8262-f9hh-4786: Netscreen running ScreenOS 4.0.0r6 and earlier allows remote attackers to cause a denial of service via a malformed SSH packet to the Secure Command Shell (SCS) management interface, as demonstrated via certain CRC32 exploits, a different vulnerability than CVE-2001-0144.
CVE-2025-34334: AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation.
CVSS v4.0: 8.7
GHSA-v6w5-cm84-v59g: Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
CVSS v3.0: 5.4
CVE-2006-2053: Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d) index.cfm, the (4) CategoryID parameter in (e) prodpage.cfm, and (5) ProdID parameter in (f) Details.cfm.  NOTE: these issues can also be exploited for path disclosure.
CVSS v2.0: 6.4
CVE-2025-11784: Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50
Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf()'. The 'GetParameter(meter)' function retrieves the user input, which is directly incorporated into a buffer without size validation. An attacker can provide an excessively large input for the 'meter' parameter.
CVSS v4.0: 8.5
GHSA-3wfg-xv96-62cq: On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.
CVSS v3.1: 5.3
CVE-2010-2381: Unspecified vulnerability in the Application Server Control component in Oracle Fusion Middleware 10.1.2.3 and 10.1.4.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2010-0081.
CVSS v2.0: 3.5
CVE-2022-20440: In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259918
CVSS v3.1: 5.5
GHSA-whhx-3948-x97c: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.
CVSS v3.1: 4.3
GHSA-cjqf-4m3m-v7rh: Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger an assertion error related to unexpected length values.
CVE-2016-10094: Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2012-1545: Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
CVSS v2.0: 5.8
GHSA-8q6c-32p2-jpvj: uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area.
CVSS v3.0: 8.8
CVE-2022-35695: AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
CVE-2023-42846: This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17.1. A device may be passively tracked by its Wi-Fi MAC address.
CVSS v3.1: 5.3
RHSA-2009:1428: Red Hat Security Advisory: xmlsec1 security update
xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass
GHSA-2j9m-xmx2-hj4v: ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364.  NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.