ansulev/circl-vulnerability-scores huggingface dataset:
ICSMA-20-023-01: GE CARESCAPE, ApexPro, and Clinical Information Center systems
A vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.CVE-2020-6961 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score. An input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.CVE-2020-6962 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.CVE-2020-6963 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.CVE-2020-6964 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score A vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.CVE-2020-6965 has been assigned to this vulnerability. A CVSS v3 base score of 8.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.CVE-2020-6966 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
CVSS v3.0: 10
CVE-2020-36459: An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore.
CVSS v3.1: 8.1
CVSS v2.0: 6.8
GHSA-fmjp-mw89-c6h6: Jenkins LDAP Plugin follows LDAP referrals
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals from the configured LDAP server. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization "gadgets" are available on the classpath.This allows attackers able to control the configured LDAP server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.LDAP Plugin 807.809.vd3a_4e5e4ec98 no longer follows LDAP referrals.
CVSS v3.1: 6.6
GHSA-9q6m-mw2x-4prg: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
CVSS v3.1: 6.5
CVE-2009-4682: Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web script or HTML via the id parameter in a vote action.
CVSS v2.0: 4.3
GHSA-59gm-4h96-737v: Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
GHSA-x85r-r67w-g27p: Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.
CVSS v3.0: 6.1
GHSA-xcjj-4x65-hrvc: Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vectors.
GHSA-r2vf-x75v-28pc: A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a design flaw in the product. An attacker could execute a query on an Event Center site to view scheduled meetings. A successful query would show both listed and unlisted meetings in the displayed information. An attacker could use this information to attend meetings that are not available for their attendance. Cisco Bug IDs: CSCvg33629.
CVSS v3.0: 4.3
CVE-2025-11534: Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series
The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.
CVSS v4.0: 9.3
CVE-2026-29226: Apache OFBiz: Low-Privilege SSRF in Content Component
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.
CVSS v3.1: 7.3
CVE-2022-50121: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
In the Linux kernel, the following vulnerability has been resolved:

remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init

Every iteration of for_each_available_child_of_node() decrements
the reference count of the previous node.
When breaking early from a for_each_available_child_of_node() loop,
we need to explicitly call of_node_put() on the child node.
Add missing of_node_put() to avoid refcount leak.
CVSS v3.1: 5.5
cisco-sa-iosxr-cli-privescl-sDVEmhqv: Cisco IOS XR Authenticated User Privilege Escalation Vulnerability
A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that command, even though administrative privileges should be required. The attacker must have valid credentials on the affected device.

The vulnerability is due to incorrect mapping in the source code of task group assignments for a specific command. An attacker could exploit this vulnerability by issuing the command, which they should not be authorized to issue, on an affected device. A successful exploit could allow the attacker to invalidate the integrity of the disk and cause the device to restart. This vulnerability could allow a user with read permissions to issue a specific command that should require Administrator privileges.

Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.


CVSS v3.1: 8.4
GHSA-c5mv-4p22-7x9x: An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected.
GHSA-8wp2-h37w-5qxq: A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D).
CVSS v3.0: 6.5
GHSA-j78m-35f9-q5jq: TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.
CVSS v3.1: 9.8
GHSA-xpcf-78h5-6vc8: The Sunday Indian Oriya (aka com.magzter.thesundayindianoriya) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
cisco-sa-20191002-cuc-inject: Cisco Unified Communications Manager SQL Injection Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries.

The vulnerability exists because the affected software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted requests that contain malicious SQL statements to the affected application. A successful exploit could allow the attacker to determine the presence of certain values in the database, impacting the confidentiality of the system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cuc-inject ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cuc-inject"]
CVSS v3.0: 4.9
GHSA-289c-42q5-rfhv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arne Informatics Piramit Automation allows Blind SQL Injection.This issue affects Piramit Automation: before 27.09.2024.
CVSS v3.1: 9.9
GHSA-ghg2-fhxj-324q: The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrative functionality to retrieve * all accounts and passwords.
CVSS v3.1: 9.8
CVE-2001-1343: ws_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter.
CVSS v2.0: 7.5
GHSA-qv8v-wr87-ccm8: SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI.
CVSS v3.0: 9.8
GHSA-w973-rg33-v5p7: In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
CVSS v3.0: 8.8
GHSA-fq43-9h9q-hmw9: An exploitable heap corruption vulnerability exists in the Doc_SetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send a malicious doc file to trigger this vulnerability.
CVSS v3.0: 8.8
CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi
In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Handle invalid decoder vsi

Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi
is valid for future use.
CVSS v3.1: 5.5
CVE-2025-58776: KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
CVSS v4.0: 8.4
CVSS v3.1: 7.8
GHSA-v38m-p57w-gg65: Cross-Site Request Forgery (CSRF) vulnerability in Amin Y AgreeMe Checkboxes For WooCommerce allows Cross Site Request Forgery. This issue affects AgreeMe Checkboxes For WooCommerce: from n/a through 1.1.3.
CVSS v3.1: 4.3
GHSA-vqv2-ch86-28w3: The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-v7p8-fjq4-c77q: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
CVSS v3.1: 8.8
GHSA-fxxx-g6pp-5cg6: Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Data Redaction. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition Data Redaction accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
CVE-2009-2511: Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via an X.509 certificate that has a malformed ASN.1 Object Identifier (OID) and was issued by a legitimate Certification Authority, aka "Integer Overflow in X.509 Object Identifiers Vulnerability."
CVSS v2.0: 7.5
GHSA-mpjx-8phj-5m34: Moodle Allows Unauthenticated Dropbox Access
The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.
CVE-2012-4449: Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2022-2701: SourceCodester Simple E-Learning System claire_blake cross site scripting
A vulnerability classified as problematic was found in SourceCodester Simple E-Learning System. This vulnerability affects unknown code of the file /claire_blake. The manipulation of the argument Bio leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205822 is the identifier assigned to this vulnerability.
CVSS v3.1: 3.5
CVE-2021-25973: Publify - Improper Authorization Leads to Guest Signup Restriction Bypass
In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
CVSS v3.1: 6.5
GHSA-vmqh-qx2h-x74p: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, there is improper access control in a file storage API.
CVSS v3.0: 9.8
GHSA-8279-hg76-9fpw: An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs.Continued receipt and processing of these specific packets will sustain the DoS condition.This issue affects Junos OS:  *  All versions before 22.2R3-S6,from 22.4 before 22.4R3-S4,from 23.2 before 23.2R2-S3,from 23.4 before 23.4R2-S4,from 24.2 before 24.2R1-S2, 24.2R2An indicator of compromise will indicate the SPC3 SPUs utilization has spiked.For example: 
   user@device> show services service-sets summary
                     Service sets                                                                               CPU
  Interface          configured       Bytes used             Session bytes used        Policy bytes used        utilization
  "interface"          1              "bytes" (percent%)     "sessions" ("percent"%)   "bytes" ("percent"%)     99.97 % OVLD  <<<<<< look for high CPU usage
CVSS v4.0: 8.7
CVSS v3.1: 7.5
ICSA-24-067-01: Chirp Systems Chirp Access (Update C)
The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable cannot be used to change the configuration settings of the door readers or locksets and does not affect the ability for authorized users of the mobile application to lock or unlock access points.
CVSS v3.1: 4.3
GHSA-rjvv-g76c-5pwg: The Authors On Tour - Live! (aka com.appmakr.app122286) application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2024-5033: SULly < 4.3.1 - Admin+ Stored XSS via CSRF
The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS v3.1: 5.9
GHSA-jq29-r496-r955: payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
ImpactA cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the `payload-preferences` internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide.**Users are affected if ALL of these are true:**Multiple auth collections configured (e.g., `admins` + `customers`)Postgres or SQLite database adapter with serial/auto-increment IDsUsers in different auth collections with the same numeric ID**Not affected:**`@payloadcms/db-mongodb` adapterSingle auth collection environmentsPostgres/SQLite with `idType: 'uuid'`PatchesThis vulnerability has been patched in **v3.74.0**. Users should upgrade to v3.74.0 or later.WorkaroundsThere is no workaround other than upgrading. Users with multiple auth collections using Postgres or SQLite with serial IDs should upgrade immediately.
CVSS v3.1: 5.4
GHSA-368w-vm6r-8gm2: Buffer overflow in the expandtabs function in 2fax 3.04 allows remote attackers to execute arbitrary code via a text file that is converted to TIFF.
CVE-2026-57663: WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
CVSS v3.1: 8.5
GHSA-xxf8-fpmr-fw7v: Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection
Withdrawn AdvisoryThis advisory has been withdrawn because it was determined to not be a vulnerability. Please see the issue [here](https://github.com/intelliants/subrion/issues/910#issuecomment-2174012538) for more information.Original DescriptionSubrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.
CVE-2024-37301: document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
CVSS v3.1: 7.2
GHSA-xj69-m9qq-8m94: Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing
ImpactQuill before version `v0.7.1` contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing.When parsing a Mach-O binary, Quill reads several size and count fields from the `LC_CODE_SIGNATURE` load command and embedded code signing structures (`SuperBlob`, `BlobIndex`) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include `DataSize`, `DataOffset`, and `Size` from the load command, `Count` from the `SuperBlob` header, and `Length` from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files.PatchesFixed in Quill `v0.7.1`WorkaroundsNoneCreditAnchore would like to thank opera-aklajn (Opera) for reporting this vulnerabilityResources[Inside code signing: hashes (Apple documentation)](https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes)
CVSS v3.1: 5.5
GHSA-hh7x-5f4p-r457: A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks.
CVSS v3.1: 5.3
CVE-2017-17518: swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being a vulnerability because “the current version of white_dune (1.369 at https://wdune.ourproject.org/) do not use a "BROWSER environment variable". Instead, the "browser" variable is read from the $HOME/.dunerc file (or from the M$Windows registry). It is configurable in the "options" menu. The default is chosen in the ./configure script, which tests various programs, first tested is "xdg-open".
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2014-8602: iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.
CVSS v2.0: 4.3