ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2014-3042: IBM CICS Transaction Server 3.1, 3.2, 4.1, 4.2, and 5.1 on z/OS does not properly implement CEMT transactions, which allows remote authenticated users to cause a denial of service (storage overlay) by using a 3270 emulator to send an invalid 3270 data stream.
CVSS v2.0: 4
CVE-2024-0426: ForU CMS cms_template.php sql injection
A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-j5wg-h8jh-fx4v: Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch).  Supported versions that are affected are 10 and  11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 7
CVE-2026-22664: prompts.chat SSRF via Fal.ai Media Status Polling
prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack of URL validation to disclose the FAL_API_KEY in the Authorization header, enabling credential theft, internal network probing, and abuse of the victim's Fal.ai account.
CVSS v4.0: 7.1
CVSS v3.1: 7.7
CVE-2020-8992: ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
CVE-2023-3667: Bit Assist < 1.1.9 - Admin+ Stored Cross-Site Scripting
The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
GHSA-6qc3-mmcj-4p92: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: do not allow CHAIN_ID to refer to another tableWhen doing lookups for chains on the same batch by using its ID, a chain
from a different table can be used. If a rule is added to a table but
refers to a chain in a different table, it will be linked to the chain in
table2, but would have expressions referring to objects in table1.Then, when table1 is removed, the rule will not be removed as its linked to
a chain in table2. When expressions in the rule are processed or removed,
that will lead to a use-after-free.When looking for chains by ID, use the table that was used for the lookup
by name, and only return chains belonging to that same table.
CVSS v3.1: 7.8
GHSA-9wmx-j898-fr8m: pgxconfig in the Raptor GFX configuration tool allows local users to gain privileges via a symlink attack.
CVE-2025-24762: WordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerability
Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.45.
CVSS v3.1: 5.4
CVE-2010-0847: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows arbitrary code execution via a crafted image.
CVSS v2.0: 7.5
GHSA-9xfv-r389-8vvf: xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
CVSS v3.0: 8.8
GHSA-v6cf-m8q2-vx93: In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.
CVSS v3.0: 7.5
GHSA-q62c-3jf5-pvpj: Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution.
GHSA-9c2h-qj4p-x84x: The Fan-Out Linux and UNIX receiver scripts in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors involving certain environment variables and "code injection."
CVE-2018-9458: In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being on the wrong window. This could lead to local escalation of privilege revealing the user's keypresses while the screen was locked with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-71786287.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2005-4596: Cross-site scripting (XSS) vulnerability in read.php in AdesGuestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the totalRows_rsRead parameter.
CVSS v2.0: 4.3
GHSA-rmxf-c923-96h6: Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware.
GHSA-c3qr-9382-24hp: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2024-48178: newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
CVSS v3.1: 8.1
GHSA-hjx7-966w-2vcm: PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent.
CVSS v3.1: 5.5
GHSA-2whq-82v3-86j7: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_tp_denuncia' and 'id_sociedad' in '/backend/api/buscarTipoDenunciabyId.php'.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-42cf-jg8h-gxrv: The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
CVSS v4.0: 8.6
GHSA-gx79-c5w9-r9rc: Multiple cross-site scripting (XSS) vulnerabilities in index.tpl in Redakto WCMS 3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) iid, (2) iid2, (3) r, (4) cart, (5) str, (6) nf, and (7) a parameters.
GHSA-6gr6-h6rg-w74p: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
CVE-2026-34930: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1: 7.8
GHSA-wv6m-vwg6-jc2q: The client in Openwsman 1.2.0 and 2.0.0, in unknown configurations, allows remote Openwsman servers to replay SSL sessions via unspecified vectors.
GHSA-xv5j-xw3x-cwr6: Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2023-23021: Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code via the code, name, and description inputs in file Main.php.
CVSS v3.1: 6.1
GHSA-c36p-gqxq-hcgq: Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.
GHSA-frqf-9qr4-6vxf: Drupal Saving user accounts can sometimes grant the user all roles
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
CVSS v3.0: 8.8
GHSA-cxv9-h4hx-92c5: Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.
CVSS v3.1: 6.1
CVE-2020-15826: In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
CVSS v3.1: 4.3
CVSS v2.0: 4
RHSA-2026:3870: Red Hat Security Advisory: OpenShift Container Platform 4.12.86 bug fix and security update
lodash: prototype pollution in _.unset and _.omit functions python-eventlet: Eventlet HTTP request smuggling github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
CVSS v3.1: 7.5
GHSA-6m67-x55h-jgr8: A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.
CVSS v3.0: 5.5
RHSA-2026:0726: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14.2.P1 for Spring Boot release.
lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing
CVSS v3.1: 7.5
GHSA-9w3j-9rg7-6282: index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.
CVSS v3.0: 6.1
GHSA-vqff-7r2x-pwc7: The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
CVSS v3.1: 6
GHSA-2xv4-x724-2399: An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/get_user_email_info_bbs.asp to obtain the contact information (name and e-mail address) of everyone in the entire organization. This information can allow remote attackers to perform social engineering or brute force attacks against the system login page.
CVSS v3.1: 5.3
CVE-2017-13689: The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2013-5739: The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.
CVSS v2.0: 3.5
RHSA-2025:8544: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript http-proxy-middleware: Denial of Service cross-spawn: regular expression denial of service express: cause malformed URLs to be evaluated webpack-dev-middleware: lack of URL validation may lead to file leak nodejs-ws: denial of service when handling a request with many HTTP headers nodejs-async: Regular expression denial of service while parsing function in autoinject golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html body-parser: Denial of Service Vulnerability in body-parser dompurify: DOMPurify vulnerable to tampering by prototype pollution golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1: 7.5
CVE-2023-41067: A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may bypass Gatekeeper checks.
CVSS v3.1: 5.5
CVE-2007-2820: Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arbitrary code via long arguments to the (1) SWAT_Init, (2) SWAT_InitEx, (3) SWAT_InitEx2, (4) SWAT_InitEx3, and (5) SWAT_Login functions.
CVSS v2.0: 7.5
CVE-2026-27413: WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.
CVSS v3.1: 9.3
CVE-2020-2268: A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-5fc4-7q74-93x4: A vulnerability was determined in Open5GS up to 2.7.7. This affects the function handle_amf_info in the library /lib/sbi/nnrf-handler.c of the component nf-instances Endpoint. Executing a manipulation of the argument nf_info_pool can lead to resource consumption. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Applying a patch is advised to resolve this issue. The issue report is flagged as already-fixed.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
GHSA-3vhj-m86h-3wmf: IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834.
GHSA-mrpp-pr56-xr94: In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVSS v3.1: 5.5
GHSA-2ghv-58hc-7529: aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component.
CVSS v3.0: 7.5
CVE-2007-3520: SQL injection vulnerability in process.php in Easybe 1-2-3 Music Store allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.
CVSS v2.0: 7.5
CVE-2023-26921: OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
CVSS v3.1: 9.8
CVE-2019-8649: A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-xv6q-xxx5-mmp4: In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2018-15452: Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability
A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrusions. To exploit this vulnerability, the attacker would need to have administrative credentials on the Windows system. The vulnerability is due to the improper validation of resources loaded by a system process at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. A successful exploit could allow the attacker to disable the targeted system's scanning services and ultimately prevent the system from being protected from further intrusion. There are no workarounds that address this vulnerability.
CVSS v3.0: 5.5
CVE-2026-44224: Wiki.js: Privilege Escalation via Missing Group Validation in users.update
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.
CVSS v4.0: 8.6
GHSA-6vqf-wwv4-9qqh: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
RHSA-2015:0838: Red Hat Security Advisory: openstack-glance security and bug fix update
openstack-glance: user storage quota bypass
CVE-2025-68086: WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6.
CVSS v3.1: 5.4
GHSA-qc8m-fmhj-x4j4: vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
CVE-2024-21748: WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
CVSS v3.1: 4.3
CVE-2015-1961: The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call.
CVSS v2.0: 9
CVE-2026-26319: OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests
OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to forge Telnyx events. Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). The issue has been fixed in version 2026.2.14.
CVSS v3.1: 7.5
GHSA-w897-x6rf-c833: Chang Lian application has a vulnerability which can be maliciously exploited to hide the calling number.Successful exploitation of this vulnerability allows you to make an anonymous call.
GHSA-w7w3-28qr-7whc: An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
CVSS v3.1: 8.7
GHSA-p37h-v38c-f75w: A vulnerability classified as problematic has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file login.php. The manipulation of the argument txtAddress leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261801 was assigned to this vulnerability.
CVSS v3.1: 3.5
GHSA-vjvj-gr2r-88wq: Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862.
GHSA-fpv2-gfx7-f277: Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 8.2
CVE-2013-3248: Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf or .xps file.
CVSS v2.0: 9.3
CVE-2024-4383: Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-52j9-8cw4-9cqq: Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
RHSA-2026:0139: Red Hat Security Advisory: httpd security update
httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
CVSS v3.1: 7.1
RHSA-2020:5135: Red Hat Security Advisory: firefox security update
Mozilla: Write side effects in MCallGetProperty opcode not accounted for
CVSS v3.0: 8.8
CVE-2019-9265: In Bluetooth, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-37994606
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-9869-mhm7-vvmm: In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.