ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-53457: WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.
CVSS v3.1: 4.4
GHSA-q4h3-8jhm-mq6c: Certain NETGEAR devices are affected by command injection. This affects R7800 before 1.0.2.16 and R9000 before 1.0.2.4.
GHSA-g24w-7v2m-52xh: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
CVSS v3.1: 6.5
CVE-2012-4926: approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.
CVSS v2.0: 6.4
CVE-2018-0472: Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability
A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to improper processing of malformed IPsec Authentication Header (AH) or Encapsulating Security Payload (ESP) packets. An attacker could exploit this vulnerability by sending malformed IPsec packets to be processed by an affected device. An exploit could allow the attacker to cause a reload of the affected device.
CVSS v3.0: 8.6
CVSS v2.0: 7.8
GHSA-6vqf-8qmc-rjr8: An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL.
Refer to the '
Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.
CVSS v4.0: 6
GHSA-wwv2-hq48-3mr9: Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id parameter in an admin/module_form action, the (4) user_id parameter in an admin/user_form action, the (5) vendor_category_id parameter in a vendor/vendor_category_form action, the (6) user_id parameter in a store/user_form action, the (7) payment_method_id parameter in a store/payment_method_form action, the (8) tax_rate_id parameter in a tax/tax_form action, or the (9) category parameter in a shop/browse action.  NOTE: the product_id vector is already covered by CVE-2008-0681.
GHSA-54c4-wwh5-5g92: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen.
CVSS v3.0: 8.8
GHSA-23r8-p7qp-rwcq: A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.
CVSS v3.1: 8.1
CVE-2023-0069: WPaudio MP3 Player <= 4.0.2 - Contributor+ Stored XSS
The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1: 5.4
GHSA-p9wv-phc4-8hqf: The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
CVE-2026-11697: Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 9.6
GHSA-wfm4-cvqx-m7rj: An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
CVSS v3.1: 9.8
CVE-2002-2370: SWS web server 0.0.4, 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline.
CVSS v2.0: 5
GHSA-3w73-4p4p-f992: Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user.
CVSS v3.1: 6.1
CVE-2026-26101: Incorrect Permission Assignment for Critical Resource in Owl opds
Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
CVSS v4.0: 8.5
CVE-2024-54331: WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through <= 1.7.3.
CVSS v3.1: 7.1
GHSA-wf3f-427r-g3fc: A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 2.4
GHSA-pf3h-rxr6-757h: PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the gl_root parameter.
RHSA-2015:2541: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update
EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server apache-commons-collections: InvokerTransformer code execution during deserialisation
CVE-2002-0650: The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Resolution Service (UDP port 1434) with a spoofed IP address of another SQL Server system, which causes the two servers to exchange packets in an infinite loop.
CVSS v2.0: 5
CVE-2006-0688: PHP remote file include vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
CVSS v2.0: 7.5
GHSA-39qg-hhmq-h5px: A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-pj2j-w9fr-j7p8: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Zones).   The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 8.2
GHSA-mxx5-2h9x-347v: Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php.
GHSA-x577-gcc9-9xjj: Concrete CMS Stored XSS in Layout Preset Name
Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.
CVSS v3.1: 4.8
CVE-2011-3513: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity, related to HTML Pages.
CVSS v2.0: 4.3
GHSA-973g-55hp-3frw: Server-Side Request Forgery in gradio
A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
CVSS v3.0: 8.6
ICSA-15-244-01: Siemens RUGGEDCOM ROS IP Forwarding Vulnerability
Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.
CVE-2021-34267: An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected endpoint.
CVSS v3.1: 4.6
CVSS v2.0: 2.1
GHSA-mhpf-h92v-4wv4: DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
CVSS v3.0: 6.1
GHSA-2mff-4q5m-q2cm: A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-7v7j-vpv5-h468: Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted.To remediate this issue, users should upgrade to version 0.8.140.
CVSS v4.0: 7.1
CVSS v3.1: 7.8
GHSA-2mrg-35hw-x3x9: Gotenberg: SSRF via LibreOffice document processing
**Summary**Server-Side Request Forgery (SSRF) vulnerability affecting the `/forms/libreoffice/convert` endpoint in Gotenberg v8.33.0 running with the default configuration.By uploading a specially crafted DOCX document, an attacker can cause LibreOffice to automatically retrieve external resources during document conversion. As a result, outbound requests are made from the server hosting Gotenberg to attacker-controlled destinations.Additionally, the same document mechanism appears capable of referencing image resources from the local filesystem. During conversion, LibreOffice attempts to load those resources and embed them into the resulting document.**PoC****External Resource Retrieval**Create a DOCX document containing the following content:`<img src="http://[ATTACKER_HOST]:[PORT]/path?query=somedata">`Upload the document to the `/forms/libreoffice/convert `endpoint.During document processing, LibreOffice automatically retrieves the referenced external resource.An outbound request can be observed on Burp Collaborator:**Local Resource Retrieval**Create a DOCX document containing the following content:`<img src="/path/to/image.png">`Upload the document to the `/forms/libreoffice/convert `endpoint.During document conversion, LibreOffice loads the referenced image from the local filesystem and embeds it into the generated output document.Result in output document (used payload - `<img src="/usr/share/pixmaps/debian-logo.png">`):**Impact**The identified vulnerability enables two primary attack vectors:Blind SSRF: The conversion service allows arbitrary outbound HTTP(S) requests during document processing. Although response bodies are not returned to the user, this can be leveraged for internal network discovery and interaction with services accessible only from the internal network or relying on network-level trust assumptions.Local File Disclosure via Image Resource Loading: The conversion engine allows local filesystem resources to be accessed during document rendering when referenced as image sources in the uploaded document. By specifying local file paths in image tags, LibreOffice resolves and embeds the referenced image content into the generated output document. This behavior is limited to resources loadable as images during document conversion, rather than general file read primitives, but may still allow retrieval of sensitive files accessible to the LibreOffice process.**Notes**The issue was reproduced on Gotenberg v8.33.0 under the default configuration.Given the impact of arbitrary outbound HTTP(S) requests (SSRF) and limited local filesystem resource disclosure via image resource loading during document conversion, this issue may warrant a CVE assignment.
CVSS v3.1: 7.5
CVE-2024-32108: WordPress Convert Post Types plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Convert Post Types.This issue affects Convert Post Types: from n/a through 1.4.
CVSS v3.1: 4.3
GHSA-7fj9-wg8v-v4f2: Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2019-13131: Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-x7x3-2wwx-wv8q: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
GHSA-2c3x-rrq4-j7xg: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ironfit ironfit allows PHP Local File Inclusion.This issue affects Ironfit: from n/a through <= 1.5.
CVSS v3.1: 8.1
GHSA-x3cq-jvfv-55p5: PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.  NOTE: it is possible that this is a vulnerability in FCKeditor.
CVE-2024-46431: Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. An attacker with access to the web management portal can exploit this vulnerability by sending specially crafted data to the delWewifiPic function.
CVSS v3.1: 8
GHSA-7p3v-c73x-wr24: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.
CVSS v3.1: 9.8
GHSA-3fwh-gvcw-q838: Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS v3.0: 6.1
GHSA-w26q-jp2w-2hvw: SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the articleid parameter to article.php.
RHSA-2014:1658: Red Hat Security Advisory: java-1.6.0-sun security update
JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: incorrect optimization of range checks in C2 compiler (Hotspot, 8022783) OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564) ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533) OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)
GHSA-w3wf-5496-hfh3: Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect availability via vectors related to Web.
CVSS v3.0: 7.7
GHSA-43fc-jf86-j433: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Denial of Service via **proto** Key in mergeConfigSummaryThe `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.DetailsThe vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:When `prop` is `'__proto__'`:`JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property`Object.keys()` includes `'__proto__'` in the iteration`mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype``Object.prototype(...)` throws `TypeError: merge is not a function`The `mergeConfig` function is called by:`Axios._request()` at `lib/core/Axios.js:75``Axios.getUri()` at `lib/core/Axios.js:201`All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`PoC**Reproduction steps:**Clone axios repository or `npm install axios`Create file `poc.mjs` with the code aboveRun: `node poc.mjs`Observe the TypeError crash**Verified output (axios 1.13.4):****Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.Impact**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.Affected environments:Node.js servers using axios for HTTP requestsAny backend that passes parsed JSON to axios configurationThis is NOT prototype pollution - the application crashes before any assignment occurs.
CVSS v3.1: 7.5
GHSA-8844-88f7-3mwf: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS v3.1: 8.8
RHSA-2025:4409: Red Hat Security Advisory: OpenShift Container Platform 4.12.76 bug fix and security update
libxml: use-after-free in xmlXIncludeAddNode kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources baremetal-operator/apis: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1: 7.5
CVE-2022-22672: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
GHSA-m679-wwqm-wjv6: Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
GHSA-8rq5-cphq-cc83: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.
CVSS v3.0: 5.5
GHSA-5vqh-qmfx-36w2: In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
CVE-2021-2343: Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 4.3
CVE-2024-30314: Dreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does require user interaction.
CVSS v3.1: 7.8
GHSA-2wwc-hfmq-5q7x: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.
CVSS v3.1: 8.8
RHSA-2012:0096: Red Hat Security Advisory: ghostscript security update
ghostscript: glyph data access improper input validation ghostscript: CWD included in the default library search path
CVE-2025-53982: WordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.
CVSS v3.1: 6.5
CVE-2006-4891: SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS v2.0: 7.5
CVE-2024-24947: A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger these vulnerability.This CVE tracks the heap corruption that occurs at offset `0xb68c4` of version 1.2.10.9 of the P3-550E firmware, which occurs when a call to `memset` relies on an attacker-controlled length value and corrupts any trailing heap allocations.
CVSS v3.1: 8.2