ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-8482: ABB Device Library Wizard Information Disclosure Vulnerability
Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data
CVSS v3.1: 7.8
GHSA-hxjp-pw3h-w6qr: Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS v3.1: 4.6
CVE-2021-2386: Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.0-20.12.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 4.3
GHSA-p33x-cg95-phvw: IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors.
CVSS v3.0: 6.5
GHSA-9h9g-93gc-623h: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
SummaryThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.Versions affected: ALLNot affected: NONEFixed versions: 1.4.4ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:allow both "math" and "style" elements,or allow both "svg" and "style" elementsCode is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:using application configuration:see https://guides.rubyonrails.org/configuring.html#configuring-action-viewusing a `:tags` option to the Action View helper `sanitize`:see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeusing Rails::Html::SafeListSanitizer class method `allowed_tags=`:using a `:tags` options to the Rails::Html::SafeListSanitizer instance method `sanitize`:All users overriding the allowed tags by any of the above mechanisms to include (("math" or "svg") and "style") should either upgrade or use one of the workarounds immediately.WorkaroundsRemove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.References[CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)https://hackerone.com/reports/1656627CreditThis vulnerability was responsibly reported by Dominic Breuker.
CVSS v3.1: 6.1
CVE-2025-62698: Stored XSS through system messages in ExternalGuidance
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.
CVSS v4.0: 6.9
CVE-2024-40747: [20250101] - Core - XSS vectors in module chromes
Various module chromes didn't properly process inputs, leading to XSS vectors.
CVSS v3.1: 6.1
CVE-2023-37010: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `eNB Status Transfer` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS v3.1: 6.3
GHSA-jvgr-9ph5-m8v4: ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float
The JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats.
CVSS v3.1: 5.5
CVE-2023-35182: SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.
CVSS v3.1: 8.8
CVE-2022-27873: An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain victim’s public IP and possibly other sensitive information.
CVSS v3.1: 7.8
GHSA-676r-wmg9-6ww8: Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.
CVSS v3.1: 5.5
GHSA-869j-r97x-hx2g: Anki's local HTTP server does not sufficiently validate requests
SummaryAnki launches a local HTTP server to serve media files and web pages for parts of its interface. The server fails to validate requests in the following ways:No sufficient validation of the Origin header.Some endpoints are vulnerable to path traversal attacks.This allows malicious websites to exfiltrate local files given a known path.Browser impactThe severity varies by browser because of Private Network Access (PNA), a newer spec that restricts web pages from making requests to localhost/local network addresses:Chrome/Chromium (including Edge, Brave): Largely protected, as Chrome has implemented PNA restrictions for several years and now puts local network access behind a permission prompt.
Safari: Hasn't implemented PNA yet, though macOS has some OS-level protections.
Firefox: Most vulnerable — hasn't implemented PNA yet, though it's reportedly planned for Firefox 151.PatchesThe issue was fixed as of Anki 25.09.3
CVSS v4.0: 8.7
CVE-2022-4802: Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS v3.0: 9.1
GHSA-hcfw-8p6f-qf35: A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.
CVE-2019-10946: An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2021-2435: Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase (component: JAPI). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Analytic Provider Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Essbase Analytic Provider Services accessible data as well as unauthorized access to critical data or complete access to all Essbase Analytic Provider Services accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
CVSS v3.1: 8.1
CVE-2017-14192: The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-p782-2pf9-qvmm: devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.
CVSS v4.0: 8.7
CVSS v3.1: 9.8
GHSA-j32j-2hxv-rqf7: pg-native and libpq vulnerable to uncontrolled resource consumption
pg-native before 3.0.1 and libpq before 1.8.10 are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.
CVSS v3.1: 7.5
GHSA-x5cx-qfrc-rw4r: Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-3q6g-2ch9-q6x7: IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004.
CVE-2015-2304: Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
CVSS v2.0: 6.4
CVE-2022-28074: Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-7fqv-r2rr-7j5v: SQL injection vulnerability in index.php in Web Directory Script 1.5.3 allows remote attackers to execute arbitrary SQL commands via the site parameter in an open action.
GHSA-gxmr-w5mj-v8hh: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS v3.1: 8.6
CVE-2023-48703: SAML authentication bypass vulnerability in RobotsAndPencils/go-saml
RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `xmlsec1` command line tool is called internally to verify the signature of SAML assertions. When `xmlsec1` is used without defining the enabled key data, the origin of the public key for the signature verification is, unfortunately, not restricted. That means an attacker can sign the SAML assertions themselves and provide the required public key (e.g. an RSA key) directly embedded in the SAML token. Projects still using RobotsAndPencils/go-saml should move to another SAML library or alternatively remove support for SAML from their projects. The vulnerability can likely temporarily be fixed by forking the go-saml project and adding the command line argument `--enabled-key-data` and specifying a value such as `x509` or `raw-x509-cert` when calling the `xmlsec1` binary in the verify function. Please note that this workaround must be carefully tested before it can be used.
CVSS v3.1: 7.5
GHSA-49f2-67r6-f6f6: Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.
GHSA-2px3-3hpp-ch4w: Off-by-one error in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
CVSS v3.0: 5.9
CVE-2020-5304: The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-v5m8-5455-qw2x: A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
CVSS v3.1: 9.6
GHSA-xfhw-6mc4-mgxf: crayon: ObjectPool creates uninitialized memory when freeing objects
As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order to write it to the pool storage.Extremely basic usage of the crate can trigger this issue, e.g. this code from a doctest:The Clippy warning for this code was silenced in commit c2fde19caf6149d91faa504263f0bc5cafc35de5.Discovered via https://asan.saethlin.dev/ub?crate=crayon&version=0.7.1
CVSS v3.1: 7.5
GHSA-62m2-79cv-f29w: Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
CVSS v3.1: 9.8
GHSA-445v-c68q-3683: A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modify sensitive data that is associated with arbitrary accounts on an affected device. The vulnerability is due to a failure to enforce access restrictions on the Help Desk and User Provisioning roles that are assigned to authenticated users. This failure could allow an authenticated attacker to modify critical attributes of higher-privileged accounts on the device. A successful exploit could allow the attacker to gain elevated privileges on the device. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. Cisco Bug IDs: CSCvd61779.
CVSS v3.0: 8.8
GHSA-rm2v-6cj6-w92v: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Creative Solutions Contact Form Generator plugin <= 2.5.5 versions.
CVSS v3.1: 7.1
CVE-2024-32904: In ProtocolVsimOperationAdapter() of protocolvsimadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
CVSS v3.1: 4.7
GHSA-pp4x-8g6c-r99v: Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send malicious file to the server.The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS v4.0: 5.1
CVSS v3.1: 6.5
CVE-2015-3676: AppleGraphicsControl in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information via a crafted app.
CVSS v2.0: 4.3
CVE-2026-47366: Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.
CVSS v3.0: 7.2
CVE-2008-1087: Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."
CVSS v2.0: 9.3
GHSA-xhq9-58fw-859p: ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API
SummaryThe `getRestQuery` method in the `@apostrophecms/piece-type` module checks whether a MongoDB projection has already been set before applying the admin-configured `publicApiProjection`. An unauthenticated attacker can supply a `project` query parameter in the REST API request to pre-populate the projection state, causing the security-enforced `publicApiProjection` to be skipped entirely. This allows disclosure of fields that the site administrator explicitly restricted from public access.DetailsWhen an unauthenticated user queries the piece-type REST API, the `getRestQuery` method processes the request at `modules/@apostrophecms/piece-type/index.js:1120`:At **[1]**, `applyBuildersSafely` iterates over all query string parameters and invokes their corresponding builder methods. The `project` builder exists in `@apostrophecms/doc-type` with a `launder` method (`doc-type/index.js:1876`) that sanitizes values to booleans:When a request includes `?project[someField]=1`, the builder sets `query.state.project` to `{someField: true}`. At **[2]**, the conditional `!query.state.project` evaluates to `false` because the state is already populated, so the `publicApiProjection` is never applied.For comparison, the `@apostrophecms/page` module's equivalent method (`page/index.js:2953`) unconditionally applies the projection:PoC**Prerequisites:** An ApostropheCMS 4.x instance with a piece-type (e.g., `article`) that has `publicApiProjection` configured to restrict fields. For example:**Step 1:** Normal request — observe restricted fields are hidden:Response returns only `title` and `_url` fields per the configured projection.**Step 2:** Bypass projection by supplying `project` query parameter:Response now includes `internalNotes`, `slug`, `createdAt`, and any other requested fields — bypassing the admin-configured `publicApiProjection` restriction.**Step 3:** Request all default fields by projecting inclusion of sensitive fields:All requested fields are returned, confirming the `publicApiProjection` is fully bypassed.Impact**Information Disclosure:** An unauthenticated attacker can read any field on documents that are already publicly queryable, bypassing administrator-configured field restrictions. This may expose internal notes, draft content, metadata, or other sensitive fields the administrator intentionally hid from the public API.**Scope:** Affects all piece-type modules with `publicApiProjection` configured. The attacker cannot access documents they wouldn't otherwise be able to query (document-level permissions still apply), but they can read any field on accessible documents.**Exploitability:** Trivial — requires only appending query parameters to a public URL. No authentication, special tools, or chaining required.Recommended FixRemove the conditional check on `query.state.project` in `piece-type/index.js`, matching the page module's unconditional behavior. The admin-configured `publicApiProjection` should always override any user-supplied projection for unauthenticated users:
CVSS v3.1: 5.3
CVE-2014-4896: The Parque Imperial (aka com.a792139893520606f84b2188a.a23428594a) application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2006-3376: Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
CVSS v2.0: 7.5
GHSA-vw4x-7247-whg9: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php.
CVSS v3.1: 6.5
CVE-2021-47734: CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
CVSS v4.0: 8.6
CVSS v3.1: 7.8
CVE-2022-32773: An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability.
CVSS v3.0: 10
CVE-2012-5007: The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merge_pdf function and incorrect arguments, a different vulnerability than CVE-2012-1625.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 5
GHSA-2xpq-xp6c-5mgj: Contao affected by insert tag injection via canonical URL
ImpactIt is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.PatchesUpdate to Contao 4.13.49, 5.3.15 or 5.4.3.WorkaroundsDisable canonical tags in the settings of the website root page.Referenceshttps://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urlsFor more informationIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-6wwm-42xv-cjjc: SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the show parameter.
CVE-2023-29693: H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function set_tftp_upgrad.
CVSS v3.1: 9.8
GHSA-j29p-v539-8x23: Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
CVSS v3.0: 7.5
CVE-2025-12258: TOTOLINK A3300R POST Parameter cstecgi.cg setOpModeCfg stack-based overflow
A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component POST Parameter Handler. The manipulation of the argument opmode results in stack-based buffer overflow. The attack may be performed from remote.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2025-15552: Long Session Lifetime in Truesec LAPSWebUI
Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
CVSS v4.0: 6
CVE-2012-5621: lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.
CVSS v2.0: 5
GHSA-mfg3-5qvp-gc4j: Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the show parameter.
GHSA-3pfw-v5wv-h5xj: Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure. Successful attacks of this vulnerability can result in unauthorized access to Oracle Cloud Infrastructure accessible data. All affected customers were notified of CVE-2022-21503 by Oracle. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.1: 4.9
GHSA-26wh-hvvw-2vc6: Unspecified vulnerability in the Oracle Data Mining component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to DMSYS.DBMS_DM_EXP_INTERNAL.