ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2012:1346: Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22) flash-plugin: multiple code-execution flaws (APSB12-22)
GHSA-c9c3-j7mh-wpfm: Macromedia Flash Player allows remote attackers to read arbitrary files via XML script in a .swf file that is hosted on a remote SMB share.
CVE-2026-50891: Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.
GHSA-wp3c-m2g9-hww6: The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604.
CVE-2026-22441: WordPress Zentrum theme <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Zentrum zentrum allows PHP Local File Inclusion.This issue affects Zentrum: from n/a through <= 1.0.
CVSS v3.1: 8.1
CVE-2022-33233: Configuration weakness in modem
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
CVSS v3.1: 7.8
CVE-2018-3008: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.0: 8.2
CVSS v2.0: 5.8
CVE-2025-65186: Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
CVSS v3.1: 6.1
GHSA-x3g5-323w-687m: Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-c857-2vfc-6jrh: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attackers to erase a device in opportunistic circumstances by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange account.
CVSS v3.0: 5.9
GHSA-cp43-7gjw-vj3h: The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
CVSS v3.1: 5.3
GHSA-4jxh-294h-xrm7: Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demonstrated by the microphone permission or the geolocation permission.
CVSS v3.0: 6.5
CVE-2026-8221: Devs Palace ERP Online item-save cross site scripting
A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-hjh9-8f7g-h763: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
GHSA-46pm-c965-776x: Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output.
CVSS v4.0: 2.3
CVSS v3.1: 4.3
GHSA-m794-h492-36rv: A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The manipulation of the argument domain_verification_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
RHSA-2023:5598: Red Hat Security Advisory: curl security update
curl: IDN wildcard match may lead to Improper Cerificate Validation curl: more POST-after-PUT confusion
CVSS v3.1: 3.7
CVE-2010-1580: Unspecified vulnerability in the SunRPC inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5), 8.0 before 8.0(5.19), 8.1 before 8.1(2.47), and 8.2 before 8.2(2) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via crafted SunRPC UDP packets, aka Bug ID CSCtc85753.
CVSS v2.0: 7.8
GHSA-x832-fpvj-r5ph: Mustangproject allows exfiltrating files via XXE attacks
Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
CVSS v3.1: 2.8
CVE-2017-1334: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126242.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-pp76-gf24-6pfg: Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter.
CVSS v3.1: 7.5
GHSA-7hm8-4vqr-ph7q: Cross-site scripting (XSS) vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-rc6f-wq75-jcqx: Weak configuration in Automotive while VM is processing a listener request from TEE.
CVSS v3.1: 7.4
GHSA-cc73-5m66-8hg8: Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors.
GHSA-6r6r-2p6c-hcvv: Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Worklist URL, then using the response times to infer the results.
GHSA-wrr7-33fx-rcvj: Deserialization of Untrusted Data in jackson-databind
**Withdrawn:** Duplicate of GHSA-cjjf-94ff-43w7
CVE-2016-5437: Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Log.
CVSS v3.0: 4.9
CVSS v2.0: 4
CVE-2008-0708: HP USB 2.0 Floppy Drive Key product options (1) 442084-B21 and (2) 442085-B21 for certain HP ProLiant servers contain the (a) W32.Fakerecy and (b) W32.SillyFDC worms, which might be launched if the server does not have up-to-date detection.
CVSS v2.0: 4.6
GHSA-479r-rg4f-86j3: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-qq9h-27w8-76xf: Vulnerability in Glance and gpm programs in GlancePlus for HP-UX 9.x and earlier allows local users to access arbitrary files and gain privileges.
CVE-2024-51698: WordPress Master Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Bar master-bar allows Reflected XSS.This issue affects Master Bar: from n/a through <= 1.0.
CVSS v3.1: 7.1
CVE-2014-8416: Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.
CVSS v2.0: 5
CVE-2026-13574: llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVSS v3.0: 3.3
CVSS v2.0: 1.7
CVE-2023-0181: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and data tampering.
CVSS v3.1: 7.1
CVE-2026-1304: Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
The Membership Plugin – Restrict Content for WordPress is vulnerable to Stored Cross-Site Scripting via multiple invoice settings fields in all versions up to, and including, 3.2.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 4.4
CVE-2025-27016: WordPress Drivr Lite – Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.
CVSS v3.1: 6.5
CVE-2014-0010: Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
CVSS v2.0: 6.8
CVE-2009-3638: Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
CVSS v2.0: 7.2
GHSA-cxqq-w3x5-7ph3: MobSF Stored Cross-Site Scripting (XSS)
**Product:** MobSF
**Version:** < 4.3.1
**CWE-ID:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
**CVSS vector v.4.0:** 8.5 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
**CVSS vector v.3.1:** 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
**Description:** Stored XSS in the iOS Dynamic Analyzer functionality.
**Impact:** Leveraging this vulnerability would enable performing actions as users, including administrative users.
**Vulnerable component:** `dynamic_analysis.html` 
https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/d1d3b7a9aeb1a8c8c7c229a3455b19ade9fa8fe0/mobsf/templates/dynamic_analysis/ios/dynamic_analysis.html#L406
**Exploitation conditions:** A malicious application was uploaded to the Correlium.
**Mitigation:** Use `escapeHtml()` function on the `bundle` variable.
**Researcher: Oleg Surnin (Positive Technologies)**ResearchResearcher discovered zero-day vulnerability Stored Cross-site Scripting (XSS) in MobSF in iOS Dynamic Analyzer functionality.
According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.).
(https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier)
However, an attacker can manually modify this value in `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value.
In the `dynamic_analysis.html` file you do not sanitize received bundle value from Corellium 
https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/d1d3b7a9aeb1a8c8c7c229a3455b19ade9fa8fe0/mobsf/templates/dynamic_analysis/ios/dynamic_analysis.html#L406*Figure 1. Unsanitized bundle*As a result, it is possible to break the HTML context and achieve Stored XSS.Vulnerability reproductionTo reproduce the vulnerability, follow the steps described below.•	Unzip the IPA file of any iOS application.
*Listing 1. Unzipping the file*•	Modify the value of `<key>CFBundleIdentifier</key>` by adding restricted characters in the `Info.plist` file.*Figure 2. Example of the modified Bundle Identifier*•	Zip the modified IPA file.*Listing 2. Zipping the file*•	Upload the modified IPA file to your virtual device using the Correlium platform.*Figure 3. Example of the uploaded malicious application*•	Open the XSS functionality and hover the mouse over the Uninstall button of the malicious app.*Figure 4. Example of the 'Uninstall' button**Figure 5. Example of the XSS**Figure 6. Example of the vulnerable code*Please, assign all credits to: Oleg Surnin (Positive Technologies)
CVSS v4.0: 8.6
CVSS v3.1: 8.1
RHSA-2021:0079: Red Hat Security Advisory: OpenShift Container Platform 3.11.374 bug fix and security update
golang.org/x/crypto: Keystream loop in amd64 assembly when overflowing 32-bit counter kubernetes: MITM using LoadBalancer or ExternalIPs python-urllib3: CRLF injection via HTTP request method
CVSS v3.1: 6.5
CVE-2019-11658: Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state.
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2025-6339: ponaravindb Hospital Management System func3.php sql injection
A vulnerability was found in ponaravindb Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /func3.php. The manipulation of the argument username1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2012-1435: The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \50\4B\4C\49\54\45 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations.
CVSS v2.0: 4.3
CVE-2024-37511: WordPress Swift Performance Lite plugin <= 2.3.6.20 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
CVSS v3.1: 4.3
CVE-2016-8953: IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118840.
CVSS v3.0: 5.4
CVSS v2.0: 4.9
CVE-2024-29816: WordPress Woo Viet plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in htdat Woo Viet allows Stored XSS.This issue affects Woo Viet: from n/a through 1.5.2.
CVSS v3.1: 5.9
CVE-2024-21176: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 5.3
PYSEC-2018-152: An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
CVSS v3.0: 7.2
GHSA-7rwf-9fg2-2mpj: An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands. An attacker needs to setup an access point reachable by the device to trigger this vulnerability.
CVSS v3.0: 6.5
GHSA-8xf4-8j68-7v4x: A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVE-2024-56042: WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
CVSS v3.1: 9.3
CVE-2004-1049: Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability."
CVSS v2.0: 5.1
CVE-2015-7337: The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
CVSS v2.0: 6.8
CVE-2024-49697: WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
CVSS v3.1: 4.3
CVE-2026-33124: Frigate has insecure password change functionality
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password does not invalidate existing JWT tokens, and there is no validation of password strength. If an attacker obtains a valid session token (e.g., via accidentally exposed JWT, stolen cookie, XSS, compromised device, or sniffing over HTTP), they can change the victim’s password and gain permanent control of the account. Since password changes do not invalidate existing JWT tokens, session hijacks persist even after a password reset. Additionally, the lack of password strength validation exposes accounts to brute-force attacks. This issue has been resolved in version 0.17.0-beta1.
CVSS v4.0: 8.6
CVE-2015-10130: The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 5.3
CVE-2002-0377: Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files.
CVSS v2.0: 2.1
CVE-2019-2015: In rw_t3t_act_handle_check_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120503926
CVSS v3.0: 8.8
CVSS v2.0: 9.3