ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-23604: Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with specially crafted multiple parameters.
CVSS v3.1: 5.4
GHSA-9574-pj7c-fmgh: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
GHSA-53mv-532r-jjc4: The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 5.5
GHSA-q9p8-33wc-h432: Authenticated users can exploit an enumeration vulnerability in Harbor
**Impact**Hidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search" functionality.Non-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with parameter "username" and value "_", as follows:`curl -X GET "https://<host>/api/users/search?username=_" -H "accept: application/json" --user <user>:<password>`The vulnerability was immediately fixed by the Harbor team and all supported versions were patched. With the patched versions of Harbor, the username is required for search and we have removed the support for querying by email.**Patches**If your product uses the affected releases of Harbor, update to either version 2.1.0 or 2.0.3 to fix this issue immediatelyhttps://github.com/goharbor/harbor/releases/tag/v2.1.0
https://github.com/goharbor/harbor/releases/tag/v2.0.3**Workarounds**There is no workaround for this issue**For more information**If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13794
CVSS v3.1: 4.3
CVE-2020-7244: Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)
CVSS v3.1: 7.2
CVSS v2.0: 9
CVE-2015-6661: Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
CVSS v2.0: 5
GHSA-f2vj-m3mq-wc4p: LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).
CVE-2025-69238: Cross-Site Request Forgery in Raytha CMS
Raytha CMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. Attacker can craft special website, which when visited by the authenticated victim, will automatically send POST request to the endpoint (e. x. deletion of the data) without enforcing token verification. 

This issue was fixed in version 1.4.6.
CVSS v4.0: 6.9
GHSA-qrvg-j482-9r53: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sherwin Calims Add Ribbon Shortcode allows DOM-Based XSS.This issue affects Add Ribbon Shortcode: from n/a through 1.0.1.
CVSS v3.1: 6.5
CVE-2016-0571: Unspecified vulnerability in the Oracle Balanced Scorecard component in Oracle E-Business Suite 11.5.10.2 and 12.1 allows remote attackers to affect confidentiality via unknown vectors.
CVSS v2.0: 5
GHSA-q588-hm8m-223f: Integer overflow in the FilterEffect::copyImageBytes function in platform/graphics/filters/FilterEffect.cpp in the SVG filter implementation in WebCore in WebKit in Google Chrome before 11.0.696.65 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted dimensions.
RHSA-2025:0284: Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: WebChannel APIs susceptible to confused deputy attack firefox: thunderbird: Use-after-free when breaking lines in text firefox: Alt-Svc ALPN validation failure when redirected firefox: Compartment mismatch when parsing JavaScript JSON module firefox: Memory corruption when using JavaScript Text Segmentation firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
CVSS v3.1: 7.5
GHSA-79hw-6hc5-jxgp: Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: High)
CVSS v3.1: 3.1
CVE-2002-0572: FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which may then be reused by a called setuid process that intended to perform I/O on normal files.
CVSS v2.0: 7.2
GHSA-w8pm-p328-pc5h: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.
CVSS v3.1: 5.3
CVE-2005-1566: Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session, which causes the shell to crash and restart, then leave the user in the new shell.
CVSS v2.0: 7.5
CVE-2024-42619: Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg.com
CVSS v3.1: 8.8
GHSA-964f-vc2f-ch6j: A Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper handling of vmstate and continuation jump instructions, which allow for continuous dynamic tail calls. An attacker can exploit this by crafting a smart contract with deeply nested jump logic. Even within permissible gas limits, this nested execution exhausts the host process's stack space, causing the validator node to crash. This results in a Denial of Service (DoS) for the TON blockchain network.
CVSS v3.1: 7.5
GHSA-ffwr-gq9f-j2rr: Cross-site request forgery (CSRF) vulnerability in the TEQneers SEO Enhancements (tq_seo) extension before 5.0.1 for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2024-0582: Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS v3.1: 7.8
PYSEC-2023-92: Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.
CVE-2022-34215: Adobe Acrobat Reader DC Annotation Polygon Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
RHSA-2020:5642: Red Hat Security Advisory: openssl security update
openssl: EDIPARTYNAME NULL pointer de-reference
CVSS v3.1: 5.9
GHSA-wv82-x4r2-74j9: Cross-site scripting (XSS) vulnerability in the Marketplace (com_marketplace) component 1.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the catid parameter in a show_category action to index.php.
GHSA-84wm-58x3-8fvc: An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
CVE-2006-0566: The LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements.
CVSS v2.0: 5
CVE-2021-47738: CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging
CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
CVE-2017-9937: In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
RHSA-2017:0127: Red Hat Security Advisory: runc security and bug fix update
docker: insecure opening of file-descriptor allows privilege escalation
CVSS v3.1: 7.5
GHSA-qffp-2rhf-9h96: tar has Hardlink Path Traversal via Drive-Relative Linkpath
Summary`tar` (npm) can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as `C:../target.txt`, which enables file overwrite outside `cwd` during normal `tar.x()` extraction.DetailsThe extraction logic in `Unpack[STRIPABSOLUTEPATH]` checks for `..` segments *before* stripping absolute roots.What happens with `linkpath: "C:../target.txt"`:Split on `/` gives `['C:..', 'target.txt']`, so `parts.includes('..')` is false.`stripAbsolutePath()` removes `C:` and rewrites the value to `../target.txt`.Hardlink creation resolves this against extraction `cwd` and escapes one directory up.Writing through the extracted hardlink overwrites the outside file.This is reachable in standard usage (`tar.x({ cwd, file })`) when extracting attacker-controlled tar archives.PoCTested on Arch Linux with `tar@7.5.9`.PoC script (`poc.cjs`):Run:Observed output:`PWNED` confirms outside file content overwrite. Link count `2` confirms the extracted file and `../target.txt` are hardlinked.ImpactThis is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction.Realistic scenarios:CLI tools unpacking untrusted tarballs into a working directorybuild/update pipelines consuming third-party archivesservices that import user-supplied tar files
CVSS v4.0: 8.2
CVE-2019-16215: The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2023-42579: Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack.
CVSS v3.1: 6.5
CVE-2015-8336: Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors.
CVSS v3.1: 4.3
CVSS v2.0: 4
cisco-sa-iosxe-ikev1-dos-XHk3HzFC: Cisco IOS XE Software Internet Key Exchange Version 1 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The attacker must have valid IKEv1 VPN credentials to exploit this vulnerability.

This vulnerability is due to improper validation of IKEv1 phase 2 parameters before the IPsec security association creation request is handed off to the hardware cryptographic accelerator of an affected device. An attacker could exploit this vulnerability by sending crafted IKEv1 messages to the affected device. A successful exploit could allow the attacker to cause the device to reload.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279"].
CVSS v3.1: 7.7
GHSA-f49p-qq99-xjf6: MySecureShell 1.31 has a Local Denial of Service Vulnerability
CVE-2008-4111: Unspecified vulnerability in Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when the FileServing feature is enabled, has unknown impact and attack vectors.
CVSS v2.0: 9.3
CVE-2024-1213: Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticated attackers to connect their facebook and instagram pages to the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 5.4
CVE-2025-22528: WordPress Huurkalender WP Plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender.nl Huurkalender WP huurkalender-wp allows Stored XSS.This issue affects Huurkalender WP: from n/a through <= 1.5.6.
CVSS v3.1: 6.5
CVE-2021-24590: Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSS
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
RHSA-2003:089: Red Hat Security Advisory: : Updated glibc packages fix vulnerabilities in RPC XDR decoder
security flaw
GHSA-59h2-37r9-3v68: The mintToken function of a smart contract implementation for Crypto Alley Shares (CAST), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVE-2025-27262: Ericsson Indoor Connect 8855 -  Improper Neutralization of Special Elements used in an OS Command Vulnerability
Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.
CVSS v4.0: 8.5
CVE-2014-3495: duplicity 0.6.24 has improper verification of SSL certificates
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2010-4053: Stack-based buffer overflow in an unspecified logging function in oninit.exe in IBM Informix Dynamic Server (IDS) 11.10 before 11.10.xC2W2 and 11.50 before 11.50.xC1 allows remote authenticated users to execute arbitrary code via a crafted EXPLAIN directive, aka idsdb00154125 and idsdb00154243.
CVSS v2.0: 9
CVE-2015-7450: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-5ww9-jg6q-38r7: File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
SummaryA low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored `share.Link.Path`. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped.Details`resourceDeleteHandler` in `http/resource.go` cleans up any share records that reference a deleted file by calling:`file.Path` here is the *logical* path from the URL of the deleting user's request (e.g. `/a`), not the absolute filesystem path. It is passed as-is to the bolt backend:**Why the design contradicts this behavior.** `share.Link` carries a `UserID` field and the application elsewhere treats shares as per-user owned resources. `shareDeleteHandler` explicitly enforces `link.UserID != d.user.ID && !d.user.Perm.Admin → 403`. The file-deletion side-effect path is the only location that bypasses this rule.ImpactIntegrity: unauthorized deletion of share-link metadata belonging to arbitrary users, including administrators.Availability: effective denial-of-service of the share-link feature — a cooperating (or malicious) low-priv user can wipe the bulk of existing share links by iterating a short set of one- and two-character prefixes.
CVSS v4.0: 7.2
GHSA-6856-cm3x-88m8: The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2, when a Chinese, Japanese, or Korean system locale is used, can access uninitialized memory during the processing of Unicode characters, which allows local users to gain privileges via a crafted application, aka "CSRSS Elevation of Privilege Vulnerability."
RHSA-2013:0605: Red Hat Security Advisory: java-1.6.0-openjdk security update
OpenJDK: Specially crafted sample model integer overflow (2D, 8007014) OpenJDK: CMM malformed raster memory corruption (2D, 8007675)
GHSA-5549-7vqp-pvxq: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS v3.1: 6.5
GHSA-25wh-jjx3-jq6q: Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
GHSA-xh28-g76m-j6rq: Buffer overflow in the register function in Ultra Star Reader ActiveX control in SSReader allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-xcph-hqh8-mmw7: An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.
CVSS v3.1: 6.1
GHSA-8vxc-r5wp-vgvc: Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses
ImpactAn issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.PatchesThe impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.Workarounds\-Referenceshttps://github.com/firecracker-microvm/versionize/pull/53
CVSS v3.1: 5.7
GHSA-2hjg-p8gh-97px: Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 8
CVE-2018-17042: An issue has been found in dbf2txt through 2012-07-19. It is a infinite loop.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-5239-56w9-hx7j: Buffer overflow in dhd_bus_flow_ring_create_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allow an attacker (who has obtained code execution on the Wi-Fi) chip to cause the device driver to perform invalid memory accesses. The Samsung ID is SVE-2018-11785.
CVSS v3.0: 6.3
GHSA-3q8f-mjcr-w4jg: Key exchange without entity authentication in the Intel(R) Security Library before version 3.3 may allow an authenticated user to potentially enable escalation of privilege via network access.
RHSA-2010:0940: Red Hat Security Advisory: JBoss Enterprise SOA Platform 4.2 and 4.3 security update
JBoss drools deserialization remote code execution
GHSA-7vqw-4gww-392j: In the Linux kernel, the following vulnerability has been resolved:ksmbd: skip lock-range check on equal size to avoid size==0 underflowWhen size equals the current i_size (including 0), the code used to call
check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1`
and can underflow for size==0. Skip the equal case.
CVE-2026-21348: Substance3D - Modeler | Out-of-bounds Read (CWE-125)
Substance3D - Modeler versions 1.22.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2001-0404: Directory traversal vulnerability in JavaServer Web Dev Kit (JSWDK) 1.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request to the WEB-INF directory.
CVSS v2.0: 5
CVE-2023-35747: D-Link DAP-2622 DDP Firmware Upgrade Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability
D-Link DAP-2622 DDP Firmware Upgrade Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20075.
CVSS v3.0: 8.8
GHSA-r92j-3xm9-53g8: QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request.
CVSS v3.0: 7.5