ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-8rgm-mpw2-pcjv: Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2019-1850: Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker would need to have valid administrator credentials on the device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker with elevated privileges could exploit this vulnerability by sending crafted commands to the administrative web management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device.
CVSS v3.0: 7.2
GHSA-6v9c-7cg6-27q7: Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
SummaryA critical Denial of Service (DoS) vulnerability exists in `marked@18.0.0`. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (`\x09\x0b\n`)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM).DetailsThe vulnerability originates in how `marked`'s block tokenizer handles unexpected whitespace characters.**Tab Character (`\x09`) Consumption**: The `space()` tokenizer matches standard whitespace using the regex `/^(?:[ \t]*(?:\n|$))+/`. When parsing the malicious payload (`\x09\x0b\n`), this rule successfully consumes the initial tab character (`\x09`).**Vertical Tab (`\x0b`) Bypass**: The remaining input is now `\x0b\n`. The newline block rule explicitly looks for spaces or standard tabs (`[ \t]`) followed by a newline. Because the vertical tab is a legacy ASCII character not accounted for in this rule, it fails to match.**Fallback to Text Tokenizer**: None of the standard block tokenizers (blockquote, code, heading, etc.) match `\x0b\n`. As a result, the parser falls through to the `text` tokenizer (`/^[^\n]+/`), which matches any character except a newline.**Infinite Recursion**: Inside `blockTokens()`, the `text` tokenizer creates a text token and subsequently calls `inlineTokens()` on the exact same content. Inside `inlineTokens()`, the text rule again matches `\x0b\n` and recursively calls `inlineTokens()`. This creates an inescapable cycle: `blockTokens() → text token → inlineTokens() → text rule matches → inlineTokens() → ...`With each recursive call allocating new token objects and concatenating strings, memory grows indefinitely until the Node.js heap limit is reached.**Vulnerable Code in `lib/marked.esm.js` (Lexer class, `blockTokens()`):**PoCThis vulnerability can be reproduced using any standard Node.js environment with `marked@18.0.0` installed.Create a file named `poc.js` with the following content:Run the script: `node poc.js`**Result:** The process will hang briefly as memory spikes, ultimately crashing with: `FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`.ImpactThis is a High-Severity Denial of Service (DoS) vulnerability via Memory Exhaustion.**Impacted Parties:** Any application, API, chatbot, or documentation system using `marked@18.0.0` (and potentially earlier versions) to parse untrusted user input is vulnerable.Because the payload requires zero authentication and only 3 bytes of data, it requires virtually no resources from the attacker to remotely crash the service and achieve a total loss of availability for the targeted application.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-9h8r-g835-9q7j: In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
GHSA-qh33-r6h9-wf62: Mingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution (RCE) vulnerability via the log_type parameter at /log/fw_security.mds.
CVSS v3.1: 8.8
CVE-2021-25246: An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.
CVSS v3.1: 6.5
CVSS v2.0: 6.4
CVE-2020-1029: An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0942, CVE-2020-0944.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2025-0969: Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function
The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.
CVSS v3.1: 6.5
GHSA-f5qm-fxvw-fwjg: A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
CVSS v3.1: 7.8
CVE-2018-12872: Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-h6c2-cmcj-x6q6: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS v3.1: 7.8
GHSA-7fj8-2w2v-gvp9: A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2021-24098: Windows Console Driver Denial of Service Vulnerability
Windows Console Driver Denial of Service Vulnerability
CVSS v3.1: 5.5
GHSA-387x-jwqw-43f3: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.
CVE-2025-62895: WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.
CVSS v3.1: 5.3
GHSA-q8j9-34qf-7vq7: Silver has unrestricted traffic between Wireguard clients
SummarySliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to:Leaked/recovered keypair (from a beacon) being used to attack operators.Port forwardings usable from other implants.DetailsSliver treat operators' Wireguard config and beacon/session's Wireguard config equally, they both connect to the wireguard listener created from the CLI.The current netstack implementation does not filter traffic between clients. 
I think this piece of code handle traffic between clients, from experimental results clients can ping and connect to each other freely, and I didn't see any filtering here either:The docs says to use a Wireguard clients and operator wg-config to connect to the same WG listener as beacons:
https://sliver.sh/docs?name=Port%20ForwardingIf the operator uses official wireguard clients that integrates with the OS's netstack (I'm using the [Windows client](https://www.wireguard.com/install/)) then their services are accessible on the wireguard interface's IP address (for example 100.64.0.3) when the services listen on 0.0.0.0 (SSH, RDP, SMB, etc) 
![image](https://github.com/user-attachments/assets/8c791655-6f77-423c-8274-389e0850436b)The beacon's wireguard private key can be recovered through a process dump or other forensic techniques.When a private key is recovered, an attacker can connect to 100.64.0.1:1337 (key exchange listener) to generate new wireguard clients without the operators' knowledge, in that way achieve persistence inside the wireguard network.PoCEasy way:Create 2 operators wireguard config.Connect them both to the wireguard listener.From one machine, ping/scan/connect to the other's services like RDP (3389), SSH (22), etc.Slightly complicated way:From the operator's machine, connect to the wireguard listener.On the attacker's machine, run a beacon.Dump the processFind the private key, public key, endpoint, etc in the dump file:
![image](https://github.com/user-attachments/assets/84d3841f-398d-4bca-939f-bf8ed2881be7)
![image](https://github.com/user-attachments/assets/000c7d02-b6f0-4b12-82e5-29eddfff93f8)
![image](https://github.com/user-attachments/assets/3d0a3e80-3a16-4434-8622-1832c5865a85)
![image](https://github.com/user-attachments/assets/a17f73ab-622b-4852-9c15-0ad5c5afa0eb)Construct a valid Wireguard config based on the strings found. On the attacker's machine, connect to the Wireguard listener.Ping/scan/connect to the other's services like RDP (3389), SSH (22), etc.ImpactThe operator's machine is impacted, if their services contain a vulnerability, an attacker can exploit it and gain RCE. If not then it could be used to gather information (Hostname, SSH signature, etc).SuggestionFilter traffic between clients with a default-deny policy.Differentiate between operators and beacons' wireguard config/clientOnly allow specific one-way traffic when the operator request to open a Wireguard port forward.Vulnerable versionsAll versions containing wireguard functionality.
CVSS v3.1: 6.3
GHSA-vp88-rj49-wqhp: The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-vp6f-h27f-4858: Unspecified vulnerability in HP Select Identity 4.01 through 4.01.010 and 4.10 through 4.13.001 allows remote attackers to obtain unspecified access via unknown vectors.
GHSA-87rm-wvwv-5r67: A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
CVSS v3.1: 7.3
GHSA-jmmm-f4ch-325f: Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allow local guest users to perform operations that were only intended to be allowed by the guest-root.
CVE-2025-69191: WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.
CVSS v3.1: 7.3
CVE-2025-58935: WordPress Lunna theme <= 1.15 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lunna lunna allows PHP Local File Inclusion.This issue affects Lunna: from n/a through <= 1.15.
CVSS v3.1: 8.1
GHSA-f8f2-54v2-r935: An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the network to be dropped. This will impact control protocols (including but not limited to routing-protocols) and lead to a Denial of Service (DoS). Continued receipt of this specific multicast traffic will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on QFX5000 and EX4600 Series: All versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R1-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2.
CVE-2024-54349: WordPress Plain Post plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This issue affects Plain Post: from n/a through <= 1.0.3.
CVSS v3.1: 6.5
CVE-2009-4858: Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.
CVSS v2.0: 4.3
GHSA-4j7m-wpc7-pfpx: Cross-site scripting (XSS) vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter.
CVSS v3.0: 6.1
RHSA-2022:7050: Red Hat Security Advisory: OpenJDK 8u352 Security Update for Portable Linux Builds
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918)
CVSS v3.1: 5.3
GHSA-8frp-pxq2-3gpq: Magento OS Command ('OS Command Injection') vulnerability
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.
CVSS v3.1: 8.4
GHSA-9rv6-gq5r-gr55: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVE-2023-31800: Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVSS v3.1: 5.4
GHSA-wq6h-3x69-r3wq: Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot allows Stored XSS.This issue affects Virtual Bot: from n/a through 1.0.0.
CVSS v3.1: 7.1
CVE-2025-26946: WordPress WP Yelp Review Slider Plugin <= 8.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
CVSS v3.1: 7.6
CVE-2025-7943: PHPGurukul Taxi Stand Management System search-autoortaxi.php cross site scripting
A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
GHSA-79w6-c88v-gfgr: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling.
GHSA-c3h6-53mq-4c3c: LulieBlog 1.0.1 and 1.0.2 does not restrict access to (1) article_suppr.php, (2) comment_accepter.php, and (3) comment_refuser.php in Admin/, which allows remote attackers to accept comments, delete comments, and delete articles via the id parameter.
GHSA-v5cp-c22v-m9jv: SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
CVE-2008-2827: The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448 and CVE-2004-0452.
CVSS v2.0: 4.6
CVE-2018-7842: A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2023-46499: Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
CVSS v3.1: 6.1
CVE-2022-50080: tee: add overflow check in register_shm_helper()
In the Linux kernel, the following vulnerability has been resolved:

tee: add overflow check in register_shm_helper()

With special lengths supplied by user space, register_shm_helper() has
an integer overflow when calculating the number of pages covered by a
supplied user space memory region.

This causes internal_get_user_pages_fast() a helper function of
pin_user_pages_fast() to do a NULL pointer dereference:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
  Modules linked in:
  CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11
  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
  pc : internal_get_user_pages_fast+0x474/0xa80
  Call trace:
   internal_get_user_pages_fast+0x474/0xa80
   pin_user_pages_fast+0x24/0x4c
   register_shm_helper+0x194/0x330
   tee_shm_register_user_buf+0x78/0x120
   tee_ioctl+0xd0/0x11a0
   __arm64_sys_ioctl+0xa8/0xec
   invoke_syscall+0x48/0x114

Fix this by adding an an explicit call to access_ok() in
tee_shm_register_user_buf() to catch an invalid user space address
early.
CVSS v3.1: 5.5
GHSA-cjc8-9v4p-h4r5: IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
CVSS v3.1: 4.3
CVE-2024-30500: WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
CVSS v3.1: 9.9
GHSA-q77p-j5gj-rmw2: An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.
CVSS v3.1: 7.5
GHSA-vxpx-29m4-gmf8: Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks
GHSA-75jv-vfxf-3865: Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code
**Path-Traversal -> Arbitrary File Write in Assemblyline Service Client****IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually.See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion.1. SummaryThe Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name.No validation / sanitisation is performed.A **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as  
`../../../etc/cron.d/evil`  
and force the client to write the downloaded bytes to an arbitrary location on disk.2. Affected Versions| Item | Value |
|---|---|
| **Component** | `assemblyline-service-client` |
| **Repository** | [CybercentreCanada/assemblyline-service-client](https://github.com/CybercentreCanada/assemblyline-service-client) |
| **Affected** | **All releases up to master branch.**  |3. CVSS 3.1 Vector & Score4. Technical Details| Field | Content |
|---|---|
| **Location** | `assemblyline_service_client/task_handler.py`, inside `download_file()` |
| **Vulnerable Line** | `file_path = os.path.join(self.tasking_dir, sha256)` |
| **Root Cause** | The `sha256` string is taken directly from the service-server JSON response and used as a file name without any validation or sanitisation. |
| **Exploit Flow** | 1. Attacker (service server) returns HTTP 200 for `GET /api/v1/file/../../../etc/cron.d/evil`.<br>2. Client writes the response body to `/etc/cron.d/evil`.<br>3. Achieves arbitrary file write (code execution if file is executable). |5. Impact**Integrity** – Overwrite any file writable by the service UID (often root).**Availability** – Corrupt critical files or exhaust disk space.**Code Execution** – Drop cron jobs, systemd units, or overwrite binaries.6. Mitigation / Fix
CVSS v3.1: 4.2
GHSA-8g9c-9q8r-972g: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.