ansulev/circl-vulnerability-scores huggingface dataset:
cisco-sa-capic-mdvul-HBsJBuvW: Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.


CVSS v3.1: 6.5
GHSA-65g9-fp5g-xmh5: freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.
GHSA-7wj9-rggf-4prj: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList. This issue affects m1.DownloadList: from n/a through 0.21.
CVSS v3.1: 6.5
GHSA-h545-qxq5-vpjg: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS v3.1: 6.5
GHSA-fhjf-83wg-r2j9: Prototype Pollution in mixin-deep
Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.RecommendationIf you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later.
If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.
CVSS v3.1: 9.8
GHSA-g3qj-j598-cxmq: fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Summaryfido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in `extractStrings()` — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.The crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint — single request, unauthenticated, instant kill.Fixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.Affected versionsfido2-lib <= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old `cbor` package — not affected.Only affects systems where `cbor-extract` native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.PoCCBOR text string header claiming 268MB in a 5-byte buffer. `extractStrings()` in extract.cpp line 87 calls `readString()` without bounds check. Reads past buffer into unmapped memory.In context: attacker intercepts WebAuthn registration response, replaces `attestationObject` with the 5-byte payload, POSTs to the registration verification endpoint. Server calls `attestationResult()` → `cbor-x.decode()` → `cbor-extract` → SIGSEGV.FixBump cbor-x to >= 1.6.3 (which pulls cbor-extract >= 2.2.1).— Malik X (@Xvush)
CVSS v3.1: 7.5
CVE-2018-1771: IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687.
CVSS v3.0: 8.4
GHSA-vfx3-5xwg-q5jm: The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
GHSA-f67q-wr6w-23jq: Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
A wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts.DetailsBoa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`.
However, a carefully constructed code could trigger a state transition from a getter method for the promise's `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.PatchesVersion 0.19.0 is patched to correctly handle this case.WorkaroundsUsers unable to upgrade to the patched version would want to use [`std::panic::catch_unwind`](https://doc.rust-lang.org/std/panic/fn.catch_unwind.html) to ensure any exceptions caused by the engine don't impact the availability of the main application.Referenceshttps://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r
CVSS v3.1: 7.5
RHSA-2026:33722: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update
net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
CVSS v3.1: 7.5
GHSA-fw39-qr37-3qq3: The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
CVSS v3.1: 5.4
CVE-2023-40679: WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.5.3.
CVSS v3.1: 6.5
CVE-2024-9810: SourceCodester Record Management System sort2_user.php cross site scripting
A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file sort2_user.php. The manipulation of the argument qualification leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
RHSA-2021:3642: Red Hat Security Advisory: OpenShift Container Platform 4.6.46 security update
kubernetes: Symlink exchange can allow host filesystem access
CVSS v3.1: 8.8
CVE-2018-9559: In persist_set_key and other functions of cryptfs.cpp, there is a possible out-of-bounds write due to an uncaught error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112731440.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2023-29759: An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.
CVSS v3.1: 5.5
GHSA-56w6-634g-9pc2: Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM_MEMLOCK limits via the mlockall call.
CVE-2014-6618: Cross-site scripting (XSS) vulnerability in Your Online Shop allows remote attackers to inject arbitrary web script or HTML via the products_id parameter.
CVSS v2.0: 4.3
CVE-2003-0777: saned in sane-backends 1.0.7 and earlier, when debug messages are enabled, does not properly handle dropped connections, which can prevent strings from being null terminated and cause a denial of service (segmentation fault).
CVSS v2.0: 5
CVE-2024-21129: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-rp8c-4xv6-27j8: The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
CVSS v3.1: 6.5
CVE-2022-29936: USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-xq88-9pxv-6rjv: Rumpus 5.1 and earlier has weak permissions for certain files and directories under /usr/local/Rumpus, including the configuration file, which allows local users to have an unknown impact by creating, modifying, or deleting files.
CVE-2014-9777: The vid_dec_set_meta_buffers function in drivers/video/msm/vidc/common/dec/vdec.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28598501 and Qualcomm internal bug CR563654.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-xr6w-643f-4rpc: A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
CVSS v3.1: 6.1
CVE-2024-5477: A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that requires specialized equipment and knowledge.  HP is releasing firmware mitigation for the potential vulnerability.
CVSS v4.0: 7.3
CVE-2025-61608: In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVSS v3.1: 7.5
CVE-2020-10956: GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-9055: The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.
CVSS v3.1: 6.4
CVE-2010-0107: Buffer overflow in an ActiveX control (SYMLTCOM.dll) in Symantec N360 1.0 and 2.0; Norton Internet Security, AntiVirus, SystemWorks, and Confidential 2006 through 2008; and Symantec Client Security 3.0.x before 3.1 MR9, and 3.1.x before MR9; allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.  NOTE: this is only a vulnerability if the attacker can "masquerade as an authorized site."
CVSS v2.0: 9.3
GHSA-8qwq-6pch-329x: Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
CVE-2020-3188: Cisco Firepower Threat Defense Software Management Interface Denial of Service Vulnerability
A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections to an affected device, which could result in a denial of service (DoS) condition. The vulnerability exists because the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this vulnerability by sending a large and sustained number of crafted remote management connections to an affected device, resulting in a buildup of those connections over time. A successful exploit could allow the attacker to cause the remote management interface or Cisco Firepower Device Manager (FDM) to stop responding and cause other management functions to go offline, resulting in a DoS condition. The user traffic that is flowing through the device would not be affected, and the DoS condition would be isolated to remote management only.
CVSS v3.0: 5.3
GHSA-jcw9-xh9j-x87m: gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files.
GHSA-78xj-8vr9-88m7: Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-5p28-63mc-cgr9: Cross-Site Scripting bypass in html-purify
All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution.No fix is currently available. Consider using an alternative package until a fix is made available.
CVE-2023-48375: SmartStar Software CWS Web-Base - Broken Access Control
SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.
CVSS v3.1: 8.8
GHSA-7375-9833-jjwc: Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
CVSS v3.1: 5.3
CVE-2025-4634: Local File Inclusion
The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to manipulate requests to view files on the filesystem
CVSS v3.1: 4.1
GHSA-2vwx-chw3-xxm7: Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 7.9
CVE-2021-41366: Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
RHSA-2022:0231: Red Hat Security Advisory: kpatch-patch security update
kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL kernel: fs_context: heap overflow in legacy parameter handling
CVSS v3.1: 7.8
GHSA-2hw2-7jq8-w9vp: The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
CVE-2018-12381: Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note: this issue only affects Windows operating systems with Outlook installed. Other operating systems are not affected.*. This vulnerability affects Firefox ESR < 60.2 and Firefox < 62.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-9292-4cm7-5jcj: Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.
CVSS v3.1: 6.5
CVE-2020-3237: Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability
A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite arbitrary files in the virtual instance that is running on the affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by including a crafted file in an application package. An exploit could allow the attacker to overwrite files.
CVSS v3.0: 6.3
CVE-2026-20447: In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10724073; Issue ID: MSV-6296.
CVSS v3.1: 6.7
GHSA-rgx6-gghj-w753: Unspecified vulnerability in Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (loss of cluster services) via unspecified vectors, aka (1) CSCsj09859 and (2) CSCsj19985.
CVE-2021-1956: Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS v3.1: 6.5
GHSA-c95q-hjp6-cfq4: ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
GHSA-f69c-hrrh-xv56: IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPP_TEMPLATE_FLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS v3.1: 6.1
GHSA-95pq-fvwq-w4hv: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network.We have already fixed the vulnerability in the following version:
Music Station 5.3.22 and later
CVSS v3.1: 7.7
RHSA-2021:5085: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 golang: net: lookup functions may return invalid host names golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents golang: crypto/tls: certificate of wrong type is causing TLS client to panic
CVSS v3.1: 6.5
CVE-2022-30717: Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink.
CVSS v3.1: 4
CVE-2024-31963: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A successful exploit could allow an attacker to gain access to sensitive information, modify system configuration or execute arbitrary commands within the context of the system.
CVSS v3.1: 6.4
GHSA-vh29-pqch-824r: HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
CVE-2017-1632: IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133178.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2016-6391: Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series of Common Industrial Protocol (CIP) requests, aka Bug ID CSCur69036.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-wmxf-v8cq-9vq8: Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as SSH private keys.
GHSA-fhhj-f5rc-qp5f: Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 4.6
CVE-2022-23184: In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.
CVSS v3.1: 6.1
CVSS v2.0: 5.8
RHSA-2023:4282: Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update
python: urllib.parse url blocklisting bypass
CVSS v3.1: 7.5
CVE-2005-1310: SQL injection vulnerability in bBlog 0.7.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVSS v2.0: 7.5
ICSA-25-051-04: Siemens SiPass Integrated
Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The product could only be exploitable in situations where a specially crafted backup set is used for a restore. The product could only be exploitable in situations where a specially crafted backup set is used for a restore.
CVSS v3.1: 9.1
GHSA-wr8j-hpcv-cgmx: Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
CVSS v3.0: 6.1
GHSA-phf4-pv5g-gxqm: XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x38536c.
CVSS v3.0: 7.8
CVE-2025-32918: Livestatus injection in autocomplete endpoint
Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
CVSS v4.0: 5.3