ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-58405: Lack of protection mechanisms against Clickjacking attacks
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
CVSS v4.0: 5.3
GHSA-vr7j-65g3-xc3f: The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a denial of service (crash) via malformed HTML tags, possibly involving a COL SPAN tag embedded in a RANGE tag.
CVE-2022-25227: Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-94c3-g97c-h69h: Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.
CVSS v3.0: 6.3
ICSA-21-341-02: Hitachi Energy XMC20 and FOX61x
This vulnerability is a weak default credential associated with TCP Port 26. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the DCN routing configuration.CVE-2021-40333 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H). This vulnerability is due to the implementation of the proprietary management protocol (TCP Port 5558), in which if SSH is activated, could cause a disruption to the NMS and NE communication.CVE-2021-40334 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
CVSS v3.0: 8.6
GHSA-gm96-jpjv-4px7: Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.
CVSS v3.1: 7.1
GHSA-79hp-7496-946g: IBM Sterling File Gateway 2.2.0 through 2.2.6 could allow a remote authenticated attacker to obtain sensitive information displayed in the URL that could lead to further attacks against the system. IBM X-Force ID: 140688.
CVSS v3.0: 4.3
GHSA-3r3r-8fjq-x3wq: Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS v3.1: 8.8
GHSA-75g9-h46f-fpxq: ** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1: 9.8
GHSA-c876-p7q9-923j: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63121644.
CVSS v3.0: 9.1
CVE-2017-14004: GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2021-25119: AGIL <= 1.0 - Admin+ Arbitrary File Upload
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
CVSS v3.1: 7.2
CVSS v2.0: 6.5
GHSA-frfp-ppfr-fx8v: Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection.
CVSS v3.1: 8.8
CVE-2013-2340: Unspecified vulnerability on the HP ProCurve JC###A, JC###B, JD###A, JD###B, JE###A, JF###A, JF###B, JF###C, JG###A, 658250-B21, and 658247-B21; HP 3COM routers and switches; and HP H3C routers and switches allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
CVSS v2.0: 10
GHSA-r5c9-rvx3-whrv: The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
GHSA-rjv4-rhw4-4c39: D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.
CVSS v3.1: 9.8
RHSA-2023:2621: Red Hat Security Advisory: mysql security update
mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: DML unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) mysql: Server: Connection Handling unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023)
CVSS v3.1: 4.9
GHSA-vj7q-773h-8qqf: The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
CVSS v3.1: 6.1
CVE-2017-17801: In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E060.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-fxhr-852h-7wfx: The Alternative Connection (aka com.wAlternativeConnection) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2023-38328: An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password.
CVSS v3.1: 4.9
GHSA-hf5m-9h24-wphr: SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
CVE-2023-41319: Remote Code Execution in Custom Integration Upload in Fides
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code. The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is `root`, and leverage that access to attack underlying infrastructure and integrated systems. This vulnerability affects Fides versions `2.11.0` through `2.19.0`. Exploitation is limited to API clients with the `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.  Exploitation is only possible if the security configuration parameter `allow_custom_connector_functions` is enabled by the user deploying the Fides webserver container, either in `fides.toml` or by setting the env var `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True`. By default this configuration parameter is disabled. The vulnerability has been patched in Fides version `2.19.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. Users unable to upgrade should ensure that `allow_custom_connector_functions` in `fides.toml` and the `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS` are both either unset or explicit set to `False`.
CVSS v3.1: 8.8
GHSA-cwgv-fxx6-cp78: Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.
CVE-2022-43380: IBM AIX denial of service

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. IBM X-Force ID: 238640.


CVSS v3.1: 6.2
CVE-2010-4110: Unspecified vulnerability in HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform on Integrity servers allows local users to gain privileges or cause a denial of service via unknown vectors.
CVSS v2.0: 5.7
RHSA-2026:10223: Red Hat Security Advisory: grafana security update
grafana: Grafana: Information disclosure of data-source passwords via public dashboards
CVSS v3.1: 7.5
CVE-1999-0745: Buffer overflow in Source Code Browser Program Database Name Server Daemon (pdnsd) for the IBM AIX C Set ++ compiler.
CVSS v2.0: 10
GHSA-4gcr-38pq-7pjw: An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter a Use-After-Free or Type Confusion and crash during handling of certain PDF files that embed specifically crafted 3D content, due to the use of a wild pointer.
CVSS v3.0: 6.5
GHSA-wvph-ghx4-mpj2: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2006-7025: SQL injection vulnerability in admin/config.php in Bookmark4U 2.0 and 2.1 allows remote attackers to inject arbitrary SQL command via the sqlcmd parameter.
CVSS v2.0: 7.5
CVE-2026-0724: WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter
The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 4.4
GHSA-mcj6-f8p9-qpgc: Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2003-0433: Multiple buffer overflows in gnocatan 0.6.1 and earlier allow attackers to execute arbitrary code.
CVSS v2.0: 7.5
CVE-2025-30935: WordPress Contact Form plugin <= 2.0.12 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Contact Form contact-form-ready allows DOM-Based XSS.This issue affects Contact Form: from n/a through <= 2.0.12.
CVSS v3.1: 6.5
GHSA-4hpf-94w8-jpmf: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.
CVSS v3.1: 9.8
GHSA-678x-xfp4-r92r: Apache Geronimo Application Server CSRF vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
CVE-2007-6110: Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.
CVSS v2.0: 4.3
GHSA-h8c8-24pf-wx4f: OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
CVSS v3.1: 9.8
CVE-2024-21456: Buffer Over-read in WLAN HOST
Information Disclosure while parsing beacon frame in STA.
CVSS v3.1: 6.5
GHSA-m6g9-g34g-jmjf: A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.
CVSS v4.0: 7.2
CVSS v3.1: 8.1
CVE-2007-3443: The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service (temporary device hang) by sending a certain SIP INVITE message, but not providing an ACK when the call is answered.
CVSS v2.0: 2.3
CVE-2025-0603: SQLi in Callvision Healthcare's Callvision Emergency Code
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection.

This issue affects Callvision Emergency Code: before V3.0.
CVSS v3.1: 9.8
CVE-2024-21454: Integer Overflow to Buffer Overflow in Automotive Telematics
Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
CVSS v3.1: 7.5
GHSA-2343-pv68-2fw3: Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MIDI file.
GHSA-p626-j6fr-4245: The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
CVSS v3.1: 6.1
GHSA-29qv-4j9f-fjw5: Unsafe object property setter in mathjs
ImpactThis security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.PatchesThe issue was introduced in mathjs `v13.1.1`, and patched in mathjs `v15.2.0`.WorkaroundsThere is no workaround without upgrading to `v15.2.0`.ReferencesYou can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad (part of PR https://github.com/josdejong/mathjs/pull/3656).
CVSS v3.1: 8.8
GHSA-q8hp-5hxm-xc58: In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in the code. This could lead to local escalation of privilege where the default assistant app is  automatically granted ROLE_ASSISTANT with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-2022-50802: ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
GHSA-mx7x-mmcr-wf43: The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.
CVSS v3.1: 6.1
GHSA-7pwg-fr27-xv9g: SQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote attackers to execute arbitrary SQL commands via the caid parameter.
CVE-2008-5793: Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[mosConfig_absolute_path] parameter to (a) install.clickheat.php, (b) Cache.php and (c) Clickheat_Heatmap.php in Recly/Clickheat/, and (d) Recly/common/GlobalVariables.php; and the (2) mosConfig_absolute_path parameter to (e) _main.php and (f) main.php in includes/heatmap, and (g) includes/overview/main.php.
CVSS v2.0: 6.8
GHSA-xf3f-qvj8-j3m2: Cross-site scripting (XSS) vulnerability in HP SOA Registry Foundation 6.63 and 6.64 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
GHSA-2r4j-4fjg-4pm7: A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS v3.0: 4.3
CVE-2018-3029: Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 12.0.4, 12.1.0, 12.3.0 and 12.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-rxg6-f53c-h5x3: In the Linux kernel, the following vulnerability has been resolved:usb: dwc2: gadget: don't reset gadget's driver->busUDC driver should not touch gadget's driver internals, especially it
should not reset driver->bus. This wasn't harmful so far, but since
commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
subsystem got it's own bus and messing with ->bus triggers the
following NULL pointer dereference:dwc2 12480000.hsotg: bound driver g_ether
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: ...
CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
Hardware name: Samsung Exynos (Flattened Device Tree)
PC is at module_add_driver+0x44/0xe8
LR is at sysfs_do_create_link_sd+0x84/0xe0
...
Process modprobe (pid: 620, stack limit = 0x(ptrval))
...
 module_add_driver from bus_add_driver+0xf4/0x1e4
 bus_add_driver from driver_register+0x78/0x10c
 driver_register from usb_gadget_register_driver_owner+0x40/0xb4
 usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
 do_one_initcall from do_init_module+0x44/0x1c8
 do_init_module from load_module+0x19b8/0x1b9c
 load_module from sys_finit_module+0xdc/0xfc
 sys_finit_module from ret_fast_syscall+0x0/0x54
Exception stack(0xf1771fa8 to 0xf1771ff0)
...
dwc2 12480000.hsotg: new device is high-speed
---[ end trace 0000000000000000 ]---Fix this by removing driver->bus entry reset.
CVSS v3.1: 5.5
GHSA-3646-gh58-xhcx: In the Linux kernel, the following vulnerability has been resolved:crypto: xts - Handle EBUSY correctlyAs it is xts only handles the special return value of EINPROGRESS,
which means that in all other cases it will free data related to the
request.However, as the caller of xts may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way.  Otherwise backlogged
requests will trigger a use-after-free.
CVSS v3.1: 7.8
GHSA-5fjp-h5ph-254r: Juniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R8-S2, 12.3 before 12.3R7, 13.1 before 13.1R4-S2, 13.2 before 13.2R5, 13.3 before 13.3R2-S2, and 14.1 before 14.1R1 allows remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments.
CVE-2011-1766: includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.
CVSS v2.0: 5.8