ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2004-2078: Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote attackers to cause a denial of service (reboot and loss of logged events) via a long request to TCP port 80, possibly triggering a buffer overflow.
CVSS v2.0: 5
GHSA-hmq2-8vrf-9w7q: Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
CVSS v3.1: 5.3
GHSA-6gp4-p4jv-2f32: A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5.
CVE-2019-17178: HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-3212: Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.
CVSS v3.1: 5.4
CVE-2025-55710: WordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure Vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects TaxoPress: from n/a through <= 3.37.2.
CVSS v3.1: 4.3
GHSA-hpjc-pfpw-w77x: Unspecified vulnerability in IBM Tivoli Directory Server (TDS) 6.0 on Linux allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.  NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVE-2017-12959: There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a remote denial of service attack.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2017-12186: xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-x79h-769h-qj92: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1: 4.9
GHSA-hv66-hx97-fv33: An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service via a crafted string.
CVSS v3.0: 7.5
GHSA-r8q8-gv4c-jp9r: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  270974.
CVSS v3.1: 6.1
RHSA-2003:285: Red Hat Security Advisory: sane-backends security update
security flaw security flaw security flaw security flaw security flaw security flaw
RHSA-2015:0813: Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: information leaks leading to ASLR bypass (APSB15-06) flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: information leaks leading to ASLR bypass (APSB15-06) flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: security bypass leading to information disclosure (APSB15-06)
CVE-2022-1781: postTabs  <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2019-9333: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109753657
CVSS v3.1: 6.5
CVSS v2.0: 5
GHSA-r75f-5x8p-qvmc: LiteLLM has SQL Injection in Proxy API key verification
ImpactA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /chat/completions`) and reach this query through the proxy's error-handling path.An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.PatchesFixed in **`1.83.7`**. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to `1.83.7` or later.WorkaroundsIf upgrading is not immediately possible, set `disable_error_logs: true` under `general_settings`. This removes the path through which unauthenticated input reaches the vulnerable query.ReferencesPatched release: [`v1.83.7-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)**Discovery Credit**: Tencent YunDing Security Lab
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-4w3j-8hm6-fjqq: IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1976805.
CVSS v3.0: 7.1
GHSA-883h-frwq-888p: Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters.
CVE-2025-59043: OpenBao vulnerable to denial of service via malicious JSON request processing
OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.
CVSS v3.1: 7.5
GHSA-pfcj-crw8-c994: The Apparound BLEND (aka com.apparound.mobile.catalogo) application 4.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-qj56-phxc-q9jq: Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General.
CVSS v3.0: 5.4
GHSA-fc42-5w56-qw7h: XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
ImpactIt's possible to execute anything with the right of the Scheduler Application sheet page.To reproduce:As a user without script or programming rights, edit your user profile with the object editor and add a new object of type XWiki.SchedulerJobClass (search for "Scheduler")In "Job Script", add the following
```{{/code}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy} {{/async}}```Click "Save & View"If the job information isn't already displayed (you should see "Job Name", "Job Description", etc.), append ?sheet=XWiki.SchedulerJobSheet to the URL.PatchesThis has been patched in XWiki 14.10.3 and 15.0 RC1.WorkaroundsWhile the fix in the scheduler itself is easy, it relies on the code macro `source` parameter, which was introduced in 14.10.2 so you have to upgrade to benefit from it.Referenceshttps://jira.xwiki.org/browse/XWIKI-20295
https://jira.xwiki.org/browse/XWIKI-20462For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)Email us at [Security Mailing List](mailto:security@xwiki.org)
CVSS v3.1: 9.9
GHSA-5j5p-cr5c-763j: An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.
CVSS v3.1: 8.8
RHSA-2024:4200: Red Hat Security Advisory: libreswan security update
libreswan: IKEv1 default AH/ESP responder can crash and restart
CVSS v3.1: 6.5
GHSA-xwff-jwf7-fmhq: Bypass vulnerability in the device management channel
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 7.1
GHSA-hjfp-2j7q-xmx4: Cross-site Scripting in JFinalCMS
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
CVSS v3.1: 5.4
RHSA-2024:3713: Red Hat Security Advisory: OpenShift Container Platform 4.12.59 bug fix and security update
python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
CVSS v3.0: 7.5
CVE-2023-50360: Video Station
A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.8.1 ( 2024/02/26 ) and later
CVSS v3.1: 8.8
GHSA-2227-jcpx-8w3r: A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured.The issue occurs in the following cases:Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n";Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n".
CVSS v4.0: 6.3
CVSS v3.1: 5.3
CVE-2009-1788: Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.
CVSS v2.0: 9.3
GHSA-87hm-fwjc-wg67: Vulnerability in the Oracle GoldenGate component of Oracle GoldenGate. The supported version that is affected is 12.2.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate. While the vulnerability is in Oracle GoldenGate, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.0: 8.6
CVE-2020-36695: File and Directory Permission Vulnerability in Hitachi Command Suite
Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS 

components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.


CVSS v3.1: 6.6
CVE-2020-2678: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N).
CVSS v3.0: 6.4
GHSA-685p-75ch-jq74: A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter.
CVSS v3.1: 6.1
CVE-2026-4621: Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.
CVSS v4.0: 6.3
GHSA-qcvh-ffq5-55f3: Transient DOS while parsing WLAN beacon or probe-response frame.
CVSS v3.1: 7.5
CVE-2022-27263: An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2015-1730: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0: 9.3
GHSA-6v54-4j58-572p: Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.
GHSA-57m4-7g8p-fcrj: A vulnerability was found in PHPGurukul Local Services Search Engine Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /serviceman-search.php. The manipulation of the argument location leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-q3pq-7jmm-xr4h: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. This vulnerability is due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit this vulnerability by installing code to a specific directory in the underlying operating system (OS) and setting a specific ROMMON variable. A successful exploit could allow the attacker to execute persistent code on the underlying OS. To exploit this vulnerability, the attacker would need access to the root shell on the device or have physical access to the device.
GHSA-2x47-7chp-vgf9: A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code.
GHSA-h8r9-5w83-vj2q: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox.
CVSS v3.1: 6.3
GHSA-jpmh-fxh8-hcqg: A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
CVSS v3.0: 4.3
GHSA-3mf9-w9xg-qcf8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound GoogleMapper allows Reflected XSS. This issue affects GoogleMapper: from n/a through 2.0.3.
CVSS v3.1: 7.1
CVE-2018-12387: A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
CVSS v3.0: 9.1
CVSS v2.0: 6.4
CVE-2024-50211: udf: refactor inode_bmap() to handle error
In the Linux kernel, the following vulnerability has been resolved:

udf: refactor inode_bmap() to handle error

Refactor inode_bmap() to handle error since udf_next_aext() can return
error now. On situations like ftruncate, udf_extend_file() can now
detect errors and bail out early without resorting to checking for
particular offsets and assuming internal behavior of these functions.
CVSS v3.1: 3.3
CVE-2024-0775: Kernel: use-after-free while changing the mount option in __ext4_remount leading
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.
CVSS v3.1: 6.7
CVE-2022-3929: Communication between the client and server partially using CORBA over TCP/IP

Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messages.


This issue affects 



  *  FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; 
  *  UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C.




List of CPEs: 
  *  cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*









CVSS v3.1: 8.3
CVE-2026-25371: WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
CVSS v3.1: 9.3
CVE-2021-23169: A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2024-27631: Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php
CVSS v3.1: 6
CVE-2004-2702: Cross-site scripting (XSS) vulnerability in login_up.php3 in Plesk 7.0 and 7.1 Reloaded allows remote attackers to inject arbitrary web script or HTML via the login_name parameter.  NOTE: this might be the same vector as CVE-2006-6451.
CVSS v2.0: 4.3
CVE-2017-16806: The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2014-6460: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52, 8.53, and 8.54 allows remote authenticated users to affect confidentiality and integrity via vectors related to QUERY.
CVSS v2.0: 4.9
CVE-2024-11662: welliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserialization
A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_vars of the file /apps/api/views/deploy_api.py of the component API Endpoint. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-j9j4-fcv7-j4w9: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVSS v3.0: 9.1
GHSA-wx3j-j8rq-8w37: In the Linux kernel, the following vulnerability has been resolved:watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe()devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe()
does not check for this case, which results in a NULL pointer
dereference.Add NULL check after devm_ioremap() to prevent this issue.
CVSS v3.1: 5.5
GHSA-9q3g-m353-cp4p: Denial of Service in Packetbeat
Packetbeat versions prior to 5.6.4 and 6.0.0 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.
CVSS v3.0: 7.5