ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gj7m-853r-289r: Grafana when using email as a username can block other users from signing in
Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.Release 9.2, latest release, also containing security fix:[Download Grafana 9.2](https://grafana.com/grafana/download/9.2)Release 9.1.8, only containing security fix:[Download Grafana 9.1.8](https://grafana.com/grafana/download/9.1.8)Release 8.5.14, only containing security fix:[Download Grafana 8.5.14](https://grafana.com/grafana/download/8.5.14)Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.Improper authentication - CVE-2022-39229SummaryOn September 7 as a result of an internal security audit we have discovered a security vulnerability in Grafana basic authentication, related to the usage of username and email address.In Grafana, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user.In addition, a user can have an email address as a username and Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where _user_1_ can register with one email address and _user_2_ can register their username as _user_1_’s email address. As a result, _user_1_ would be prevented to sign in Grafana, since _user_1_ password won’t match with _users_2_ email address.The CVSS score for this vulnerability is 4.3 Moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).Impacted versionsAll installations for Grafana versions <=9.x, <=8.xSolutions and mitigationsTo fully address CVE-2022-39229 please upgrade your Grafana instances. 
Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud).Reporting security issuesIf you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint isF988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CAThe key is available from keyserver.ubuntu.com.Security announcementsWe maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.You can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).
CVSS v4.0: 5.1
CVSS v3.1: 4.3
GHSA-jhcc-2gg3-8q6c: Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow.
GHSA-99f9-5wx7-q4fv: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
GHSA-jj4j-x5ww-cwh9: Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden
SummaryCertain bulk action calls with a `before_transaction` hook and no `after_transaction` hook, will call the `before_transaction` hook before authorization is checked and a Forbidden error is returned, when called as a bulk action.The impact is that a malicious user could cause a `before_transaction` to run even though they are not authorized to perform the whole action. The `before_action` could run a sensitive/expensive operation.ImpactA malicious user could cause a `before_action` to run even though they are not authorized to perform the whole action.You are affected if you have an create, update or destroy action that:has a before_transaction hook on it, and no after_transaction hook on it.is being used via an `Ash.bulk_*` callback (which AshJsonApi and AshGraphql do for update/destroy actions)Whether or not or how much it matters depends on the nature of those before_transaction callbacks. If those before_transaction callbacks are side-effectful, or just doing something like looking up some external data. If your API endpoints are behind authentication and what kind.SeverityThe severity for this was hard to gauge. `before_transaction` hooks are not that commonly used. Additionally, any attacker must know which of these things are available to them, be authenticated to make such a request (i.e you very rarely have policies preventing the running of anonymous queries), so privileges and inside knowledge are required. Additionally, the action will always return a `forbidden` error, so no information is revealed. We will evaluate and adjust the severity in the next few days as needed.It is currently marked as High, given that we really don't know what logic folks are putting in their before_transaction hooks and it could theoretically be very bad.WorkaroundsYou should update ASAP, but if for whatever reason you cannot update, you can add logic to those before_transaction hooks to prevent them from doing their logic before they should.
CVSS v4.0: 7.1
CVSS v3.1: 5.6
GHSA-p4jc-hx56-jqh2: The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2016-9067: Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.
CVSS v3.0: 6.5
CVSS v2.0: 5
GHSA-xp9f-h8r8-p4j7: ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVSS v3.1: 9.3
GHSA-rg2c-ffr7-g2v8: An improper access control vulnerability  was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on the file parameter of the HTTP request. Attackers can exploit this flaw to access files outside their authorized scope, provided the file has readable permissions for other users on the underlying OS. This can lead to unauthorized exposure of sensitive data.
Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.
CVSS v4.0: 7.1
CVE-2020-17131: Chakra Scripting Engine Memory Corruption Vulnerability
Chakra Scripting Engine Memory Corruption Vulnerability
CVSS v3.1: 4.2
GHSA-6jcp-4mfr-qvpm: ** DISPUTED **  os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file.  NOTE: the vendor disputes this issue, stating "the insecure code path should only ever run inside a d-i environment, which has no non-root users."
GHSA-243v-fw8h-4xp3: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.
CVSS v3.0: 4.5
GHSA-ff4p-698h-c645: Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2000-0141: Infopop Ultimate Bulletin Board (UBB) allows remote attackers to execute commands via shell metacharacters in the topic hidden field.
CVSS v2.0: 10
CVE-2023-52558: OpenBSD 7.4 and 7.3 m_split() network buffer kernel crash
In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.
CVSS v3.1: 7.5
GHSA-m36x-mgfh-8g78: Subdomain Takeover in Interactsh server
A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `< 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.This issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.ImpactThis allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.PatchesUpdate to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`Referenceshttps://github.com/projectdiscovery/interactsh/issues/136For more informationIf you have any questions or comments about this advisory:Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)
CVSS v3.1: 6.1
CVE-2024-55040: Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters.
CVSS v3.1: 6.1
CVE-2016-9048: Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain setups access the underlying operating system.
CVSS v3.0: 7.4
CVE-2011-4558: Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters.
CVSS v3.1: 7.2
CVSS v2.0: 6
CVE-2025-3727: PCMan FTP Server STATUS Command buffer overflow
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2023-46102: The Android Client application, when enrolled to the AppHub server, connects to an MQTT
broker to exchange messages and receive commands to execute on the HMI device.
The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application.


This issue allows an attacker able to control a malicious MQTT broker on the same subnet
network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
CVSS v3.1: 8.8
GHSA-4hvj-22qf-4g8p: A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
GHSA-p949-3pv4-rcwj: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through 1.4.7.
CVSS v3.1: 9
GHSA-2r4h-9r32-83xj: There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.
CVSS v3.1: 7.2
CVE-2021-25503: Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.
CVSS v3.1: 5
CVE-2024-45014: s390/boot: Avoid possible physmem_info segment corruption
In the Linux kernel, the following vulnerability has been resolved:

s390/boot: Avoid possible physmem_info segment corruption

When physical memory for the kernel image is allocated it does not
consider extra memory required for offsetting the image start to
match it with the lower 20 bits of KASLR virtual base address. That
might lead to kernel access beyond its memory range.
CVSS v3.1: 5.5
GHSA-7x76-cmrq-q6j7: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
CVSS v3.1: 7.5
CVE-2024-41167: Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-2qpq-mrrj-2hc9: The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page.
RHSA-2011:0259: Red Hat Security Advisory: flash-plugin - 1-Month End Of Life Notice
The flash-plugin package on Red Hat Enterprise Linux 4 contains multiple
security flaws and should no longer be used. This is the 1-month
notification of Red Hat's plans to disable Adobe Flash Player 9 on Red Hat
Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical
security impact.
CVE-2023-40071: Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.3
CVE-2017-10014: Vulnerability in the Oracle Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/RESTAPI). The supported version that is affected is 1.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Hotel Mobile. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Hotel Mobile accessible data. CVSS 3.0 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
CVSS v3.0: 3.5
CVSS v2.0: 3.5
GHSA-vf9r-c7v2-7275: File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission.
GHSA-84r5-9fwf-5v5f: Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
GHSA-hv6c-6rww-5vx8: Ewido Security Suite 4.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
GHSA-gfgr-857q-jxp3: HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
CVSS v3.1: 7.4
CVE-2006-2686: PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.
CVSS v2.0: 6.4
GHSA-h85v-cx5m-78wj: Answer vulnerable to Cross-site Scripting
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CVSS v3.1: 5.4
GHSA-76v6-f83q-pxvh: Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-jq4m-q6p2-8gwc. This link is maintained to preserve external references.Original DescriptionAllocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.This issue affects hackney: from 2.0.0 before 4.0.1.
CVSS v4.0: 8.2
CVSS v3.1: 7.5
CVE-2024-47536: starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
CVSS v4.0: 4.8
GHSA-w3gv-97rc-43jh: The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-jmpm-4h56-g275: In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
CVSS v3.1: 4.9
RHSA-2023:7515: Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 9.0.0 security update
kubernetes: Insufficient input sanitization on Windows nodes leads to privilege escalation kubernetes: Insufficient input sanitization on Windows nodes leads to privilege escalation golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVSS v3.1: 7.5
CVE-2022-27868: A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-pxjr-cxmc-3gcg: Stack-based buffer overflow in the SetSkin function in AtHoc toolbar allows remote attackers to execute arbitrary code via a long skin name.
GHSA-prh5-fm3v-6477: AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS v3.1: 5.4
GHSA-gq6w-8mr2-x44j: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.
CVSS v3.0: 7.8
CVE-2008-4890: SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2023-25078: DoS due to heap overflow
Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. 

See Honeywell Security Notification for recommendations on upgrading and versioning. 


CVSS v3.1: 9.8
GHSA-w5w5-8vfh-xcjq: whoami stack buffer overflow on several Unix platforms
With versions of the whoami crate >= 0.5.3 and < 1.5.0, calling any of these functions leads to an immediate stack buffer overflow on illumos and Solaris:`whoami::username``whoami::realname``whoami::username_os``whoami::realname_os`With versions of the whoami crate >= 0.5.3 and < 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms:BitrigDragonFlyBSDFreeBSDNetBSDOpenBSDThis occurs because of an incorrect definition of the `passwd` struct on those platforms.As a result of this issue, denial of service and data corruption have both been observed in the wild. The issue is possibly exploitable as well.This vulnerability also affects other Unix platforms that aren't Linux or macOS.This issue has been addressed in whoami 1.5.0.For more information, see [this GitHub issue](https://github.com/ardaku/whoami/issues/91).
CVSS v3.1: 8.2
CVE-2004-2108: Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) search.asp, (2) browse.asp, (3) details.asp, (4) showcat.asp, (5) users.asp, (6) addtomylist.asp, (7) modline.asp, (8) cart.asp, or (9) newuser.asp.
CVSS v2.0: 7.5
CVE-2023-48252: The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.
CVSS v3.1: 8.8
CVE-2015-2004: The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2023-7035: automad Setting post.php cross site scripting
A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2023-36602: Windows TCP/IP Denial of Service Vulnerability
Windows TCP/IP Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-cx7g-7m3q-6pv3: S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
CVSS v3.0: 9.8
CVE-2018-13479: The mintToken function of a smart contract implementation for SlidebitsToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.1: 7.5
CVSS v2.0: 5