ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-12387: Improper Input Validation in binary-husky/gpt_academic
A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.
CVSS v3.0: 6.5
GHSA-gc8w-x73w-p4rh: yii2-mcp-server has a Command Injection Issue
A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2025-53994: WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through <= 2.0.15.
CVSS v3.1: 6.5
GHSA-9mqg-8rmc-j296: Missing Authorization vulnerability in gunnarpayday Payday allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Payday: from n/a through 3.3.12.
CVSS v3.1: 5.8
CVE-2024-34506: An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.
CVSS v3.1: 7.5
CVE-2025-69268: Spectrum reflected XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier.
CVSS v4.0: 5.3
CVE-2002-0046: Linux kernel, and possibly other operating systems, allows remote attackers to read portions of memory via a series of fragmented ICMP packets that generate an ICMP TTL Exceeded response, which includes portions of the memory in the response packet.
CVSS v2.0: 5
CVE-2024-49018: SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2020-10832: An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. Kernel Wi-Fi drivers allow out-of-bounds Read or Write operations (e.g., a buffer overflow). The Samsung IDs are SVE-2019-16125, SVE-2019-16134, SVE-2019-16158, SVE-2019-16159, SVE-2019-16319, SVE-2019-16320, SVE-2019-16337, SVE-2019-16464, SVE-2019-16465, SVE-2019-16467 (March 2020).
CVSS v3.1: 7.8
CVSS v2.0: 4.6
CVE-2025-11962: Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS.

This issue affects Digital Corporate Warehouse: before v.4.8.2.22.
CVSS v3.1: 7.3
GHSA-467w-qm37-mp96: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
GHSA-xw9c-j6h9-9vjc: Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.
CVE-2017-0746: A elevation of privilege vulnerability in the Qualcomm ipa driver. Product: Android. Versions: Android kernel. Android ID: A-35467471. References: QC-CR#2029392.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2024-5685: Broken Function Level Authorization (BFLA) in snipe/snipe-it
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
CVSS v3.1: 7.6
GHSA-x3c7-p6rq-8fr6: A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field.
CVSS v3.1: 4.6
GHSA-4gvc-39c7-c8j4: Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-2hgc-w527-6cxw: In the Linux kernel, the following vulnerability has been resolved:net: fec: remove .ndo_poll_controller to avoid deadlocksThere is a deadlock issue found in sungem driver, please refer to the
commit ac0a230f719b ("eth: sungem: remove .ndo_poll_controller to avoid
deadlocks"). The root cause of the issue is that netpoll is in atomic
context and disable_irq() is called by .ndo_poll_controller interface
of sungem driver, however, disable_irq() might sleep. After analyzing
the implementation of fec_poll_controller(), the fec driver should have
the same issue. Due to the fec driver uses NAPI for TX completions, the
.ndo_poll_controller is unnecessary to be implemented in the fec driver,
so fec_poll_controller() can be safely removed.
CVSS v3.1: 5.5
GHSA-hgj3-cggc-7jc2: The vulnerability, if exploited, could allow a miscreant with read 
access to Edge Project files or Edge Offline Cache files to reverse 
engineer Edge users' app-native or Active Directory passwords through 
computational brute-forcing of weak hashes.
CVSS v4.0: 8.3
CVSS v3.1: 8.4
GHSA-hvhq-mcxw-w38r: This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
CVSS v4.0: 7.5
CVSS v3.1: 8.8
GHSA-h747-6mfh-5w98: An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.
CVSS v3.0: 4.8
GHSA-mrmx-jfw8-qhgv: Melis Platform CMS SQL Injection
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
CVSS v4.0: 9.3
CVE-2022-27050: BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2020-1294: An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1287.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2021-29930: An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-pj25-44r7-9g5g: A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2010-2474: JBoss Enterprise Service Bus (ESB) before 4.7 CP02 in JBoss Enterprise SOA Platform before 5.0.2 does not properly consider the security domain with which a service is secured, which might allow remote attackers to gain privileges by executing a service.
CVSS v2.0: 3.5
CVE-2006-6119: mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages.
CVSS v2.0: 5
GHSA-3r5f-57cx-rf5j: Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious path into the search directories, which the application could unknowingly execute. This could allow the attacker to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction.
CVSS v3.1: 7.8
RHSA-2020:5340: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update
hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
CVSS v3.1: 7.5
CVE-2020-29299: Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.
CVSS v3.1: 7.2
CVSS v2.0: 9
CVE-2026-42684: WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection.

This issue affects WP Job Portal: from n/a through 2.5.1.
CVSS v3.1: 9.3
CVE-2021-47359: cifs: Fix soft lockup during fsstress
In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix soft lockup during fsstress

Below traces are observed during fsstress and system got hung.
[  130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s!
CVSS v3.1: 5.5
GHSA-xx83-cxmq-x89m: Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
CVSS v3.1: 5.9
GHSA-vjcx-j6g9-f23x: A Remote Code Execution vulnerability in HPE UCMDB version v10.10, v10.11, v10.20, v10.21, v10.22, v10.30, v10.31 was found.
CVSS v3.0: 9.8
CVE-2026-5726: ASDA-Soft Stack-based Buffer Overflow Vulnerability
ASDA-Soft Stack-based Buffer Overflow Vulnerability
CVSS v3.1: 7.8
GHSA-32jx-75mj-c5hj: Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."
GHSA-25xm-hr59-7c27: github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)
Impactxz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.PatchesThe problem has been fixed in release v0.5.8.WorkaroundsLimit the size of the compressed file input to a reasonable size for your use case.ReferencesThe standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.For more informationIf you have any questions or comments about this advisory:Open an issue in [xz](https://github.com/ulikunitz/xz/issues).
CVSS v3.1: 7.5
GHSA-3jm3-4qp6-4ghh: Stack-based buffer overflow in GOM Player 2.0.12.3375 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the "ref href" tag.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-vv73-j722-jwwp: A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
CVE-2022-40538: Reachable assertion in Modem
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
CVSS v3.1: 7.5
CVE-2022-1122: A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-r596-gfj2-gc78: In the Linux kernel, the following vulnerability has been resolved:wifi: rtw89: fix null pointer access when abort scanDuring cancel scan we might use vif that weren't scanning.
Fix this by using the actual scanning vif.
CVSS v3.1: 5.5
CVE-2007-4046: SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS v2.0: 7.5
GHSA-c9w6-g4p4-77xq: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2012-0371: Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.4, when CPU-based ACLs are enabled, allow remote attackers to read or modify the configuration via unspecified vectors, aka Bug ID CSCtu56709.
CVSS v2.0: 9.3
GHSA-q85h-h79c-h39c: Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position.
GHSA-g2vc-gpm2-rp4w: CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.
GHSA-7rw5-6f53-767h: An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures.
GHSA-p9wg-pjwr-cp67: The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address.
CVSS v3.1: 7.5
CVE-2024-35058: An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.
CVSS v3.1: 7.5
CVE-2024-42169: HCL MyXalytics is affected by insecure direct object references
HCL MyXalytics is affected by insecure direct object references.  It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
CVSS v3.1: 7.1
GHSA-qm8j-xf5h-2573: Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer.
GHSA-6hf2-chq7-2mhh: DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.
CVSS v3.1: 6.3
CVE-2025-0600: Stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x
A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS v3.1: 8.7
CVE-2016-3745: Multiple buffer overflows in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides an AudioEffect reply, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28173666.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-g83w-9px8-cmhv: IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAdd function.
CVSS v3.1: 9.8
CVE-2020-29361: An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2020-29059: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default panger123 password for the suma123 account for certain old firmware.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-11003: An issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
RHSA-2009:0019: Red Hat Security Advisory: hanterm-xf security update
xterm: arbitrary command injection
GHSA-q2c4-3vph-r3ph: Adobe Shockwave Player before 12.0.4.144 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3359.
CVE-2026-35635: OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat
OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.
CVSS v4.0: 6.3
CVSS v3.1: 4.8
CVE-2022-33235: Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS v3.1: 8.2
GHSA-mq8m-q79f-mxpq: ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.
GHSA-xcg6-wrw2-2vh5: A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS v3.1: 5.4
GHSA-gvx8-5rvg-hjxw: VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client.
CVSS v3.0: 7.8
RHSA-2007:0774: Red Hat Security Advisory: kernel security and bugfix update
ia64 crash Kernel: CAPI overflow
CVE-2014-8608: The K7Sentry.sys kernel mode driver (aka K7AV Sentry Device Driver) before 12.8.0.119, as used in multiple K7 Computing products, allows local users to cause a denial of service (NULL pointer dereference) as demonstrated by a filename containing "crashme$$".
CVSS v2.0: 4.9
CVE-2025-12036: Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-24h8-cpqm-qmf3: Cross-Site Request Forgery in Jenkins Convertigo Mobile Platform Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.
CVSS v3.1: 4.3
CVE-2001-0645: Symantec/AXENT NetProwler 3.5.x contains several default passwords, which could allow remote attackers to (1) access to the management tier via the "admin" password, or (2) connect to a MySQL ODBC from the management tier using a blank password.
CVSS v2.0: 7.5
CVE-2023-47778: WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control luckywp-scripts-control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through <= 1.2.1.
CVSS v3.1: 4.3
CVE-2000-0980: NMPI (Name Management Protocol on IPX) listener in Microsoft NWLink does not properly filter packets from a broadcast address, which allows remote attackers to cause a broadcast storm and flood the network.
CVSS v2.0: 5
CVE-2014-7509: The A Very Short History of Japan (aka com.ireadercity.c51) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-fcj6-8xpv-3w93: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVSS v3.0: 9.8
GHSA-gp75-j23f-w8j9: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set .
CVSS v3.1: 7.5
GHSA-rhm8-6pc7-6j49: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Faulting Address controls Branch Selection starting at STDUEPubFile!DllUnregisterServer+0x0000000000039335."
CVSS v3.0: 7.8
PYSEC-2020-44: This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
CVE-2022-2339: Server-Side Request Forgery (SSRF) in nocodb/nocodb
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
CVSS v3.0: 9.1
GHSA-q8rg-9c8g-rv67: In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible
CVSS v3.1: 6.1
CVE-2021-24926: Domain Check < 1.0.17 - Reflected Cross-Site Scripting
The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue
CVSS v3.1: 6.1
CVSS v2.0: 4.3