ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-87pf-fpwv-p7m7: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication
SummaryWhen authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value.DetailsA hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the SCRAM server-first-message, causing the client to perform an expensive `OpenSSL::KDF.pbkdf2_hmac` call.   Because the PBKDF2 function is a blocking C extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby VM for the duration of the computation.OpenSSL enforces an effective maximum by using a 32-bit signed integer for the iteration count,  Depending on hardware capabilities and OpenSSL version, this iteration count may be sufficient for to block all Ruby threads in the process for over seven minutes.This is listed as one of the "Security Considerations", in [RFC 7804](https://www.rfc-editor.org/rfc/rfc7804.html#page-15):A hostile server can perform a computational denial-of-service attack on clients by sending a big iteration count value.  In order to defend against that, a client implementation can pick a maximum iteration count that it is willing to use and reject any values that exceed that threshold (in such cases, the client, of course, has to fail the authentication).ImpactDuring SCRAM authentication to a hostile server, the entire Ruby VM will be locked for the duration of the computation.  Depending on hardware capabilities and OpenSSL version, this may take many minutes.`OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be used to guard against this.  And it retains the Global VM lock, so other ruby threads will also be unable to run.MitigationUpgrade to a patched version of `net-imap` that adds the `max_iterations` option to the `SASL-*` authenticators, and call `Net::IMAP#authenticate` with a `max_iterations` keyword argument.**NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32 bit integer, the maximum allowed by OpenSSL.
_To prevent a denial of service attack,_ this must be set to a safe value, depending on hardware and version of OpenSSL.
_It is the user's responsibility_ to enforce minimum and maximum iteration counts that are appropriate for their security context.Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted servers.
CVSS v4.0: 6
CVE-2021-24395: Embed Youtube Video <= 1.0 - Authenticated SQL Injection
The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
GHSA-9pmj-qm26-jq78: DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.
RHSA-2023:2111: Red Hat Security Advisory: OpenShift Container Platform 4.12.16 security update
go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents
CVSS v3.1: 7.5
GHSA-vr25-3f4m-xw8f: SQL injection vulnerability in index.php in the Simpleboard (com_simpleboard) 1.0.3 Stable component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a view action.
CVE-2025-64705: Frappe user was able to access the submission of other students
Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.
CVSS v4.0: 1.3
GHSA-v9wr-p4fq-7wqh: An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS v3.1: 7.5
CVE-2022-48338: An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
CVSS v3.1: 7.3
CVE-2024-0626: WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler
The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid.
CVSS v3.1: 5.3
GHSA-p8xm-42r7-89xg: wasmtime has a panic when allocating a table exceeding the size of the host's address space
ImpactWasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component.This bug does not affect the pooling allocator which limits tables sizes to much less than the required amount to trigger the overflow. This bug is only present for the on-demand instance allocator, which is Wasmtime's default allocator. This bug also requires the `memory64` WebAssembly feature to be enabled, which is on-by-default.Panicking in the host process is considered a denial-of-service vector for Wasmtime.PatchesWasmtime 36.0.8, 43.0.2, and 44.0.1 have all been released which fixes this issue.WorkaroundsEmbeddings can switch to using the pooling allocator to work around this issue, or the `memory64` WebAssembly proposal can be disabled. Otherwise there is no workaround and users are recommended to upgrade.
CVSS v4.0: 5.9
CVE-2009-4140: Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
CVSS v2.0: 7.5
GHSA-rf6c-qmjq-7g7g: Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear whether this poses a vulnerability.
CVE-2024-11984: SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
CVSS v4.0: 9.4
CVE-2021-1861: An issue existed in determining cache occupancy. The issue was addressed through improved logic. This issue is fixed in macOS Big Sur 11.3. A malicious website may be able to track users by setting state in a cache.
CVSS v3.1: 4.3
CVSS v2.0: 4.3
GHSA-qv98-75v6-5rhf: The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS v3.1: 6.1
GHSA-pp38-h74p-76w2: Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.  NOTE: some third parties report inability to verify this issue.
GHSA-2qjw-vxcp-7h8g: emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
CVSS v3.1: 6.5
CVE-2017-12958: There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-qvrw-vpg6-fx6m: In the Linux kernel, the following vulnerability has been resolved:net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()If queue entry or DMA descriptor list allocation fails in
airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a
NULL pointer dereference running netif_napi_del() for RX queue NAPIs
since netif_napi_add() has never been executed to this particular RX NAPI.
The issue is due to the early ndesc initialization in
airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc
value to check if the queue is properly initialized. Fix the issue moving
ndesc initialization at end of airoha_qdma_init_tx routine.
Move page_pool allocation after descriptor list allocation in order to
avoid memory leaks if desc allocation fails.
CVE-2017-6403: An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and password.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2024-38462: iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.
CVSS v3.1: 9.8
CVE-2026-24285: Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
cisco-sa-20190619-imc-frmwr-dos: Cisco Integrated Management Controller Denial of Service Vulnerability
A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition.

The vulnerability is due to insufficient checking of an input buffer. An attacker could exploit this vulnerability by passing a crafted file to the affected system. A successful exploit could inhibit an administrator's ability to access the system.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-frmwr-dos ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-frmwr-dos"]
CVSS v3.0: 5.5
CVE-2023-48654: One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.
CVSS v3.1: 9.8
CVE-2020-4242: IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175419.
CVSS v3.0: 8.8
GHSA-9347-cf5g-8j34: An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute.
GHSA-j3gx-2473-5fp8: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVSS v3.1: 7.5
CVE-2017-3407: Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
CVSS v3.0: 8.2
CVSS v2.0: 5.8
GHSA-4qcp-whvm-5mwc: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
CVSS v3.1: 5.8
GHSA-rww9-grv5-7qxf: IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account.
GHSA-mr4g-fqm8-vjpv: A vulnerability in Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker could exploit this vulnerability by sending crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. To exploit this vulnerability via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for an affected system. To exploit this vulnerability via SNMP Version 3, the attacker must know the user credentials for the affected system. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, have been configured to be queried over SNMP, and have Network Address Translation (NAT) enabled. Cisco Bug IDs: CSCve75818.
CVSS v3.0: 6.3
GHSA-vj6f-q4w6-qx9p: Plaintext Storage of a Password in Jenkins Eagle Tester Plugin
Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS v3.1: 6.5
GHSA-rjh2-gmgg-8r92: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
CVSS v3.1: 9.8
CVE-1999-1229: Quake 2 server 3.13 on Linux does not properly check file permissions for the config.cfg configuration file, which allows local users to read arbitrary files via a symlink from config.cfg to the target file.
CVSS v2.0: 2.1
GHSA-wvmq-w7m8-g9xm: Insecure cookie storage in Apache Atlas
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
CVSS v4.0: 5.3
CVSS v3.0: 6.1
GHSA-hqgr-6w6j-4xpp: The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS v3.1: 5.3
RHSA-2019:1300: Red Hat Security Advisory: go-toolset-1.11-golang security update
golang: CRLF injection in net/http
CVSS v3.0: 5.3
GHSA-756f-6j3f-48q9: Directory Traversal in calmquist.static-server
Affected versions of `calmquist.static-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.**Example request:**RecommendationNo patch is available for this vulnerability.It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
CVSS v3.0: 7.5
GHSA-g7m6-859q-xfqp: A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224237 was assigned to this vulnerability.
CVSS v3.1: 7.5
CVE-2017-11029: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
GHSA-wq9j-6h98-5f7j: ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands.
GHSA-xcm6-w86x-xg6r: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as database credentials in configuration files. A local attacker with access to the configuration files could use this information to launch further attacks.
GHSA-cvhv-59pg-p7r4: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.
CVSS v3.1: 7.6
CVE-2025-49481: Resource leaks in router
Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pbwork-queue.C.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS v3.1: 5.4
CVE-2020-9552: Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-qp9j-573m-xrwq: A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456). Affected by this issue is the function setWrlAccessList of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250706 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
CVE-2020-7850: Douzone ActiveX File Download and Execution Vulnerability
NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
CVSS v3.1: 7.8
GHSA-95vj-g5cr-7j53: mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).
CVSS v3.0: 8.1
GHSA-h9w6-f932-gq62: ses's global contour bindings leak into Compartment lexical scope
ImpactWeb pages and web extensions using `ses` and the `Compartment` API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code.PatchesThis compromise is addressed in `ses` version `1.12.0`. The mechanism for confining third-party code involves a `with` block and a semi-opaque scope `Proxy`. The proxy previously revealed any named property to the surrounding lexical scope if it were absent on `globalThis`, so that the third-party code would receive an informative `ReferenceError`, relying on the invalid assumption that only properties of `globalThis` are in the top-level lexical scope. The solution makes the scope proxy fully opaque. Consequently, accessing an unbound free lexical name will produce `undefined` instead of throwing `ReferenceError`.
Assigning to an unbound free lexical name will continue to throw a `ReferenceError`.WorkaroundsThis problem can be mitigated either by avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, which is an existing industry best-practice, or change these to `var` bindings to be reflected on `globalThis`, or upgrade `ses` to version `1.12.0` or greater.Some bundlers by default transform top-level `let`, `const`, and `class` bindings to `var`.DisclosureThis vulnerability was disclosed by @mingijunggrape in the course of their studies at UNIST (Ulsan National Institute of Science and Technology) as a member of the Web Security Lab (https://websec-lab.github.io/).
CVSS v4.0: 8.7
CVE-2019-25553: CEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed Image
CEWE PHOTO IMPORTER 6.4.3 contains a denial of service vulnerability that allows local attackers to crash the application by importing a specially crafted image file. Attackers can create a malformed JPG file with an oversized buffer and trigger the crash through the import functionality during the image processing workflow.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
GHSA-754x-4jwp-cqp6: Cross-Site Scripting in http_server
All versions of `http_server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.RecommendationNo fix is currently available. Consider using an alternative package until a fix is made available.
CVSS v3.1: 7.5
GHSA-j485-xjwc-7p25: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.21.0.
CVSS v3.1: 4.3