ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gr62-2592-229q: Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of service (application crash) via a large fragment, as demonstrated by a call to audioop.lin2lin with a long string in the first argument, leading to a buffer overflow.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3143.5.
GHSA-2p93-pprm-392q: Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.
GHSA-5594-v4cp-2cvj: In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: do not run mt76u_status_worker if the device is not runningFix the following NULL pointer dereference avoiding to run
mt76u_status_worker thread if the device is not running yet.KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware
name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: mt76 mt76u_tx_status_data
RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0
Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00
48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f>
b6
04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7
RSP: 0018:ffffc900005af988 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a
RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c
R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8
R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 mt76x02_send_tx_status+0x1d2/0xeb0
 mt76x02_tx_status_data+0x8e/0xd0
 mt76u_tx_status_data+0xe1/0x240
 process_one_work+0x92b/0x1460
 worker_thread+0x95/0xe00
 kthread+0x3a1/0x480
 ret_from_fork+0x1f/0x30
Modules linked in:
--[ end trace 8df5d20fc5040f65 ]--
RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0
Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00
48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f>
b6
04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7
RSP: 0018:ffffc900005af988 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a
RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c
R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8
R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0
PKRU: 55555554Moreover move stat_work schedule out of the for loop.
GHSA-jg6g-8j59-vr29: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVSS v3.1: 5.3
CVE-2005-0772: VERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307 for Netware, allows remote attackers to cause a denial of service (Remote Agent crash) via (1) a crafted packet in NDMLSRVR.DLL or (2) a request packet with an invalid (non-0) "Error Status" value, which triggers a null dereference.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-29176: Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVSS v3.1: 8.8
GHSA-92m6-46vg-vqrh: The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920.
CVE-2010-0590: The CMSIPUtility component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP Register message, aka Bug ID CSCtc37188.
CVSS v2.0: 7.8
CVE-2016-1513: The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2010-2484: The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.
CVSS v2.0: 5
CVE-2025-31539: WordPress Cryptocurrency Widgets Pack plugin <= 2.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets Pack: from n/a through <= 2.0.1.
CVSS v3.1: 6.5
GHSA-h26c-rrrx-f2q4: In the Linux kernel, the following vulnerability has been resolved:drm/v3d: Fix potential memory leak in the performance extensionIf fetching of userspace memory fails during the main loop, all drm sync
objs looked up until that point will be leaked because of the missing
drm_syncobj_put.Fix it by exporting and using a common cleanup helper.(cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501)
CVSS v3.1: 5.5
CVE-2005-0682: Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs.
CVSS v2.0: 4.3
GHSA-cr6q-j4hh-gx6r: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
CVE-2022-3298: Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
CVSS v3.0: 5.3
CVE-2025-1224: ywoa UserMapper.xml listNameBySql sql injection
A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2017-9330: QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
CVSS v3.1: 5.6
CVSS v2.0: 1.9
CVE-2017-18792: NETGEAR D6100 devices before 1.0.0.50_0.0.50 are affected by command injection.
CVSS v3.0: 8.4
GHSA-wxc3-3jv6-vx77: In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-257029915
CVSS v3.1: 4.4
GHSA-2w3r-4r55-xfpw: Multiple cross-site scripting (XSS) vulnerabilities in the Send-A-Card (sr_sendcard) extension 2.2.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2021-21228: Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS v3.1: 4.3
CVSS v2.0: 4.3
GHSA-w4g8-c7r7-rx85: Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.
CVSS v3.0: 6.5
RHSA-2023:7691: Red Hat Security Advisory: OpenShift Container Platform 4.11.55 bug fix and security update
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVSS v3.1: 7.5
GHSA-p3hj-cfhm-7g6v: Moodle allows attackers to remove wiki pages
mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki.
CVE-2024-38971: vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting (XSS) in the system backend.
CVSS v3.1: 5.4
CVE-2023-1711: A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. 
If exploited an attacker could obtain confidential information.



List of CPEs:
  *  cpe:2.3:a:hitachienergy:foxman_un:R9C:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:foxman_un:R10C:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R11A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R11B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R14A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R14B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R15A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R15B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy:foxman_un:R16A:*:*:*:*:*:*:*

  *  
  *  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy: unem :R10C:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R11A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R11B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R14A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R14B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R15A:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R15B:*:*:*:*:*:*:*

  *  cpe:2.3:a:hitachienergy: unem :R16A:*:*:*:*:*:*:*



CVSS v3.1: 4
GHSA-7h56-5554-rc7g: Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.
CVSS v3.1: 4.3
GHSA-g34j-q536-5j2m: EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-mcvg-7cc2-jr3f: Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability."
CVE-2007-2999: Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account names.
CVSS v2.0: 1.8
RHSA-2013:1852: Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.4 security update
rubygems: Two security fixes in v1.8.23 rubygems: Two security fixes in v1.8.23 rubygems: version regex algorithmic complexity vulnerability cumin: missing authorization checks in forms, charts, and csv export widgets cumin: CSRF protection does not work cumin: non-persistent XSS possible due to not escaping set limit form input cumin: filtering table operator not checked, leads to potential SQLi
RHSA-2026:8852: Red Hat Security Advisory: rhc security update
net/url: Incorrect parsing of IPv6 host literals in net/url
CVSS v3.1: 7.5
GHSA-wfvj-pf5x-3547: Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
CVSS v3.0: 5.3
GHSA-52hh-4qqc-mxwh: The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP addresses from accessing the device. The device doesn't properly escape the information passed in the variables 'unblockip' and 'blockip' before calling the shell_exec() function which allows for system commands to be injected into the device. The code erroneously suggests that the information handled is protected by utilizing the variable name 'escapedips' - however this was not the case. The Sophos ID is NSWA-1258.
CVSS v3.0: 7.2
GHSA-9942-r22v-78cp: TensorFlow vulnerable to `CHECK` fail in `LRNGrad`
ImpactIf `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack.PatchesWe have patched the issue in GitHub commit [bd90b3efab4ec958b228cd7cfe9125be1c0cf255](https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255).The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Di Jin, Secure Systems Labs, Brown University
CVSS v3.1: 5.9
CVE-2020-36476: An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-f8c8-v22w-8vv8: Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via an X.509 certificate that has a malformed ASN.1 Object Identifier (OID) and was issued by a legitimate Certification Authority, aka "Integer Overflow in X.509 Object Identifiers Vulnerability."
GHSA-8862-4xwm-p4pp: A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges.
CVSS v3.1: 5.1
CVE-2015-9197: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, when enabling XPUs for SMEM partitions, if configuration values are out of range, memory access outside the SMEM may occur and set incorrect XPU configurations.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2020-17419: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11192.
CVSS v3.0: 7.8
CVE-2022-40027: SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTask.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter.
CVSS v3.1: 6.1
GHSA-j2pc-4wh8-7v7q: There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.
CVSS v3.0: 7.5
CVE-2025-9792: itsourcecode Apartment Management System e_all_info.php sql injection
A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /e_dashboard/e_all_info.php. Such manipulation of the argument mid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2025-48143: WordPress Formulario de contacto SalesUp! plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through <= 1.0.14.
CVSS v3.1: 7.1
GHSA-qq64-7fh7-7hmw: mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
RHSA-2019:1487: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: race condition in snd_seq_write() may lead to UAF or OOB-access kernel: Race condition in sound system can lead to denial of service Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service
CVSS v3.0: 5.3
GHSA-pmgw-894q-7f55: In intr_data_copy_cb of btif_hd.cc, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 6.2
GHSA-m9ff-gfr6-j4w9: Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-x44m-v68f-crcx: gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site, as demonstrated by GNOME Web (aka Epiphany).
CVSS v3.0: 6.5
GHSA-hj85-pmjm-xqx2: IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980.
GHSA-v5rm-77g4-wp7f: The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
CVSS v3.0: 5.5
GHSA-cg5v-fvrh-4wvf: Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters.
CVE-2020-24454: Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime Standard Edition before version 20.2 may allow unauthenticated user to potentially enable information disclosure via network access.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2022-44435: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
CVSS v3.1: 5.5
GHSA-f5r8-hh53-9mq4: Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVE-2006-2958: Directory traversal vulnerability in FilZip 3.05 allows remote attackers to write arbitrary files via a .. (dot dot) in a (1) .rar, (2) .tar, (3) .jar, or (4) .gz file.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0: 2.6
CVE-2012-3116: Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, and 6.2 allows local users to affect confidentiality via unknown vectors.
CVSS v2.0: 1.9
GHSA-337f-xr2x-6fcf: Apache Kerby LdapIdentityBackend LDAP Injection vulnerability
An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3.
CVSS v3.1: 9.8
CVE-2014-7996: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477.
CVSS v2.0: 6.8
GHSA-rcfw-xqp3-ffpr: The installation program for HP-UX Visualize Conference B.11.00.11 running on HP-UX 11.00 and 11.11 installs /etc/dt and its subdirecties with insecure permissions, which allows local users to read or write arbitrary files.
CVE-2006-1076: SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
CVSS v2.0: 7.5
CVE-2014-9112: Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
CVSS v2.0: 5
CVE-2024-13296: Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
CVSS v3.1: 6.6
GHSA-62f9-vg37-v934: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
CVSS v3.1: 7.5