ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-23652: Privilege escalation using hop-by-hop Connection header
capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
CVSS v3.1: 8.8
CVE-2026-44301: Hugo: Node tool execution allows file system access outside the project directory
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
CVSS v4.0: 6.2
CVE-2014-0006: The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
CVSS v2.0: 4.3
GHSA-4967-792x-v69h: The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat sections on the homepage.
CVSS v3.1: 5.3
GHSA-c4wm-58w2-w4m2: Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0: 7.8
GHSA-xr22-3p6x-xw4f: A vulnerability has been found in Tenda F456 1.0.0.5. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2007-2298: Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the repertoire_config parameter to index.php in (1) cpe/, (2) direction/, or (3) professeurs/.
CVSS v2.0: 7.5
GHSA-6m5h-jcmx-5cxc: Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2024-4306: Unrestricted Upload of File with Dangerous Type vulnerability in HubBank
Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution.
CVSS v3.1: 9.9
RHSA-2013:0600: Red Hat Security Advisory: java-1.7.0-oracle security update
OpenJDK: Specially crafted sample model integer overflow (2D, 8007014) OpenJDK: CMM malformed raster memory corruption (2D, 8007675)
RHSA-2026:24833: Red Hat Security Advisory: Red Hat Quay 3.17.3
mirror-registry: remote code execution using pickle deserialization mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
CVSS v3.1: 5.2
CVE-2006-1897: Webplus (aka talentsoft) Web+Shop 5.3.6, when Redirect URL for "Script Not Found" Error is not configured, allows remote attackers to obtain sensitive information via a quote (') or possibly other invalid value in the storeid parameter in store.wml in webplus.exe, which reveals the path in a "Script Not Found" error message.
CVSS v2.0: 5
CVE-2001-0559: crontab in Vixie cron 3.0.1 and earlier does not properly drop privileges after the failed parsing of a modification operation, which could allow a local attacker to gain additional privileges when an editor is called to correct the error.
CVSS v2.0: 7.2
GHSA-8xwv-54r7-jg42: Memory leak in the web framework in the server in Cisco Unified Presence (CUP) allows remote attackers to cause a denial of service (memory consumption) via malformed TCP packets, aka Bug ID CSCug38080.
GHSA-ww7r-m379-j2pg: WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
CVE-2026-6654: Use-After-Free and Double-Free in IntoIter::drop when element drop panics
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
CVSS v3.1: 5.1
CVE-2019-8767: A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. Processing a maliciously crafted string may lead to heap corruption.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2017-8139: HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-45ff-6jrg-vc97: Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1: 8.1
CVE-2026-1484: Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()
A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.
CVSS v3.1: 4.2
GHSA-v4c4-58mq-6g8m: A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standing.php of the component HTTP GET Parameter Handler. Performing a manipulation of the argument sid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2025-25228: Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla
A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.
CVSS v3.1: 3.8
GHSA-rp78-4562-gx3c: Duplicate Advisory: pimcore is vulnerable to cross-site scripting in translate module
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of [GHSA-hfmg-g39c-5444](https://github.com/advisories/GHSA-hfmg-g39c-5444). This link is maintained ot preserve external references.Original DescriptionCross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
GHSA-gf36-rwr4-jchr: The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests.
GHSA-5vrc-4fj4-9cmh: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
CVSS v3.1: 7.5
GHSA-r37m-3hw5-974w: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10.
CVSS v3.1: 7.5
RHEA-2020:2262: Red Hat Enhancement Advisory: rh-varnish6 bug fix and enhancement update
varnish: denial of service handling certain crafted HTTP/1 requests
CVSS v3.0: 7.5
GHSA-73hc-m4hx-79pj: mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
SummaryThe `/api/health/detailed` endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When `MCP_ALLOW_ANONYMOUS_ACCESS=true` is set (required for the HTTP server to function without OAuth/API key), this endpoint is accessible without authentication. Combined with the default `0.0.0.0` binding, this exposes sensitive reconnaissance data to the entire network.DetailsVulnerable Code**`health.py:90-101` - System information collection****`health.py:131-132` - Database path disclosure**Authentication Bypass PathThe `/api/health/detailed` endpoint uses `require_read_access` which calls `get_current_user`. When `MCP_ALLOW_ANONYMOUS_ACCESS=true`, the auth middleware grants access:**Note**: The basic `/health` endpoint (line 68) has **no auth dependency at all** and returns version and uptime information unconditionally.Information Exposed| Field | Example Value | Reconnaissance Value |
|-------|--------------|---------------------|
| `platform` | `"Linux"` | OS fingerprinting |
| `platform_version` | `"#1 SMP PREEMPT_DYNAMIC..."` | Kernel version → CVE targeting |
| `python_version` | `"3.12.1"` | Python CVE targeting |
| `cpu_count` | `8` | Resource enumeration |
| `memory_total_gb` | `32.0` | Infrastructure profiling |
| `database_path` | `"/home/user/.mcp-memory/memories.db"` | Username + file path disclosure |
| `database_size_mb` | `45.2` | Data volume estimation |Attack ScenarioAttacker scans the local network for services on port 8000Finds mcp-memory-service with HTTP enabled and anonymous accessCalls `GET /api/health/detailed`  (no credentials needed)Receives OS version, Python version, full database path (revealing username), system resourcesUses this information to:Target known CVEs for the specific OS/Python versionIdentify the database file location for potential direct accessProfile the system for further attacksPoCImpact**OS fingerprinting**: Exact OS and kernel version enables targeted exploit selection**Path disclosure**: Database path reveals username, home directory structure, and file locations**Resource enumeration**: CPU, memory, and disk info reveal infrastructure scale**Reconnaissance enablement**: Combined information significantly reduces attacker effort for follow-up attacksRemediation**Remove system details from default health endpoint** - return only `status`, `version`, `uptime`:**Do not expose `database_path`** - this leaks the filesystem structure:**Add auth to basic `/health`** or limit it to status-only (no version):Alternatively, **Bind to `127.0.0.1` by default** instead of `0.0.0.0`, preventing network-based reconnaissance entirely:Users who need network access can explicitly set `MCP_HTTP_HOST=0.0.0.0`, making the exposure a conscious opt-in rather than a default.
CVSS v3.1: 5.3
CVE-2025-22434: In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-rv2w-qxpc-j296: Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v3.0: 6.1
CVE-2022-40740: Realtek GPON router - Command Injection
Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
CVSS v3.1: 7.2
GHSA-phc8-67cv-f47x: A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
CVSS v3.1: 7.8
CVE-2017-10889: TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-q7cx-f48p-82m3: tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c.
CVSS v3.0: 9.8
GHSA-4cpj-7jmp-8g84: SQL injection vulnerability in jobs/jobseekers/job-info.php in Diesel Job Site allows remote attackers to execute arbitrary SQL commands via the job_id parameter.
GHSA-mqq7-wxx5-mp8h: ps_checkout allows unauthorized method invocation through unvalidated parameter
ImpactUnvalidated parameter can lead to some unauthorized method invocation with very little possibilities.PatchesThe problem has been patched in versionsv5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build numbers.CreditsPrestaShop thanks [PATICEO](https://www.paticeo.com/) for reporting the issue.
CVSS v4.0: 2.7
GHSA-p4pr-3vww-7g7v: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744
CVSS v3.1: 6.4
GHSA-v72x-28mp-7gx5: Directory traversal vulnerability in the web server in Asus Video Security 3.5.0.0 and earlier allows remote attackers to read arbitrary files via "../" or "..\" sequences in the URL.
GHSA-9c3c-p8mj-7wvw: bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.
GHSA-6fjr-v73c-vqxr: Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.
CVSS v3.1: 5.4
GHSA-635v-pc42-fr74: AWS SageMaker Training Toolkit logs CodeArtifact Authorization token
DescriptionFor SageMaker Training Toolkit[1] versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact (temporary token with an expiration of 12 hours) were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their CloudWatch Log streams, anyone having access to cloudwatch logs within their AWS account, may be abe to see the authorization token. If the token is not expired, they may use the authorization token to publish or consume CodeArtifact package versions.This issue was addressed in version 4.8.0. We recommend users upgrade to version 4.8.0 or higher.Please note that users can add SageMaker Training Toolkit to any Docker container[2] used for SageMaker training[3]. It also comes pre-packaged with the prebuilt SageMaker Docker image[4] for SageMaker training.PatchesThis issue has been addressed in version 4.8.0 and higher.WorkaroundsN/AReferencesN/AIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page[5] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.[1] https://github.com/aws/sagemaker-training-toolkit
[2] https://www.docker.com/resources/what-container/
[3] https://aws.amazon.com/sagemaker/train/
[4] https://docs.aws.amazon.com/sagemaker/latest/dg/pre-built-containers-frameworks-deep-learning.html
[5] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting
CVSS v4.0: 5.6
CVSS v3.1: 4.2
GHSA-pjj8-v87q-7v27: Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode (a) 0x107 or (b) 0x10a.
CVSS v3.0: 9.8
CVE-2010-5076: QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS v2.0: 4.3
GHSA-9chg-p5j8-vxvp: Directory traversal vulnerability in the _serve_request_multiple function in lib/Perlbal/ClientHTTPBase.pm in Perlbal before 1.70, when concat get is enabled, allows remote attackers to read arbitrary files in a parent directory via a directory traversal sequence in an unspecified parameter.  NOTE: some of these details are obtained from third party information.
GHSA-349h-vrrw-f3cp: IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 5.4
CVE-2026-48566: Windows DWM Core Library Information Disclosure  Vulnerability
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
CVE-2025-60925: codeshare v1.0.0 was discovered to contain an information leakage vulnerability.
CVSS v3.1: 5.3
GHSA-92rm-pww6-vhmq: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tady Walsh Tito allows DOM-Based XSS.This issue affects Tito: from n/a through 2.3.
CVSS v3.1: 6.5
CVE-2016-1985: HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS v3.0: 10
CVSS v2.0: 10
CVE-2024-21318: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2024-9734: Tungsten Automation Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Tungsten Automation Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24400.
CVSS v3.0: 7.8
CVE-2014-8923: The (1) IBM Tivoli Identity Manager Active Directory adapter before 5.1.24 and (2) IBM Security Identity Manager Active Directory adapter before 6.0.14 for IBM Security Identity Manager on Windows, when certain log and trace levels are configured, store the cleartext administrator password in a log file, which allows local users to obtain sensitive information by reading a file.
CVSS v2.0: 1.9
GHSA-rffc-8fg5-72fw: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
CVE-2014-7101: The Talk Radio Europe (aka com.nobexinc.wls_31251464.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-gcj2-vrf9-pxj6: Buffer overflow in the exception handler in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCuc27639.
GHSA-h4rj-c89h-xh23: Storage Spaces Controller Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26441, CVE-2021-40478, CVE-2021-40489, CVE-2021-41345.
CVSS v3.1: 7.8
CVE-2016-1269: Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R9, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R8, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R4-S1, 15.1 before 15.1R2, 15.1X49 before 15.1X49-D30, and 16.1 before 16.1R1 allow remote attackers to cause a denial of service (socket consumption) via crafted TCP timestamps.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
CVE-2021-27581: The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-9x76-mxx2-773v: In all Android releases from CAF using the Linux kernel, a race condition exists in a QTEE driver potentially leading to an arbitrary memory write.
CVSS v3.0: 5.9
CVE-2014-6913: The Dive The World (aka com.paperton.wl.divetheworld) application 1.53 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2026-11084: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
GHSA-8wp3-cp9v-44fm: Cross-Site Scripting in marked
Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
GHSA-c5x5-p58w-fxgh: elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.
CVSS v3.1: 4
GHSA-2r5x-pjf9-75qm: Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 4
CVE-2018-2566: Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported versions that are affected are 3.x and 4.x. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Integrated Lights Out Manager (ILOM). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Integrated Lights Out Manager (ILOM), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized access to critical data or complete access to all Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS v3.0: 7.7
CVSS v2.0: 4