ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-mgjw-2wrp-r535: Remote code execution in xwiki-platform
ImpactIt's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki.PatchesThe problem has been patched in XWiki 13.1RC1 with a complete refactoring of the Reset password feature.WorkaroundsThere's different possible workarounds, all consisting in modifying the XWiki/ResetPassword page.the Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword pagethe script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.Referenceshttps://jira.xwiki.org/browse/XWIKI-16661For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira](https://jira.xwiki.org)Email us at [Security mailing-list](mailto:security@xwiki.org)
CVSS v3.1: 8.8
CVE-2025-27645: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permission Methods on the Server Side V-2024-005.
CVSS v3.1: 9.8
CVE-2016-15027: meta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scripting
A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicated leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221496.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-x8gq-24mw-873w: The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests.
GHSA-rmhq-3pj8-86qj: An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.
CVSS v3.1: 4.9
GHSA-j65v-8w29-j7f4: Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2020-9747: Double-free vulnerability in Adobe Animate 20.5
Adobe Animate version 20.5 (and earlier) is affected by a double free vulnerability when parsing a crafted .fla file, which could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS v3.1: 7.8
GHSA-rcvg-jj3g-rj7c: Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints
The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising.Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `"**********"` placeholder value.This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs.Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.ImpactThe Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.Endpoints impacted:`GET /api/v1/connections``PATCH /api/v1/connections``GET /api/v1/connection/{connection_key}``PATCH /api/v1/system/{system_key}/connection``GET /api/v1/system/{system_key}``GET /api/v1/system/{system_key}/connection`Connection config secret schemas impacted:`BigQuerySchema`PatchesThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotationWorkaroundsThere are no workarounds.Proof of conceptMultiple endpoints are impacted, but this PoC will use `GET /api/v1/system/{system_key}` as an example.Using the Admin UI, navigate to `/add-systems`. Add and save a new system `bq_poc`.In the integrations tab of the new system, configure and save a BigQuery integration with secrets.Log in as a different user with any role except Approver and navigate to the `/systems` page.Open the network section of your browser's developer tools.Click on the `bq_poc` system's meatball menu and then click edit.In the network section of browser dev tools you will observe a HTTP GET http://localhost:8080/api/v1/system/bq_poc/ request. In the body of the JSON response the integration secrets values entered in Step 2 are exposed in plaintext i.e.
CVSS v3.1: 6.5
GHSA-hh98-prpp-927v: D-Link DAP-1325 HNAP SetAPLanSettings SubnetMask Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18814.
CVSS v3.0: 8.8
CVE-2018-10823: An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
CVSS v3.1: 8.8
CVSS v2.0: 9
CVE-2026-12211: Intelbras iNVU 7016 FT Web syslog path traversal
A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the component Web Interface. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS v4.0: 5.1
CVSS v3.1: 2.7
CVSS v3.0: 2.7
CVSS v2.0: 3.3
GHSA-2gf3-m6c4-6gx9: The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via deserialization of untrusted input from the reqpars parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS v3.1: 9.8
CVE-2022-48583: A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVSS v3.1: 8.8
GHSA-9wp6-c53h-c89m: A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.
CVSS v3.1: 6.7
GHSA-hfc8-w5f4-3x6m: Ironic Standalone Operator's controller modifies user-owned resources without consent
ImpactThe Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.PatchesFixed in v0.9.0, v0.8.2, v0.7.3.WorkaroundsManually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.Resourceshttps://github.com/metal3-io/ironic-standalone-operator/pull/619https://github.com/metal3-io/ironic-standalone-operator/pull/664https://github.com/metal3-io/ironic-standalone-operator/pull/665
CVSS v3.1: 4.3
GHSA-x67p-9m2r-fxqv: Fleet server may terminate unexpectedly when handling certain gRPC requests
SummaryFleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host.ImpactAn authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint.This vulnerability impacts **availability only**. There is:No exposure of sensitive dataNo authentication bypassNo privilege escalationNo integrity impactWorkaroundsIf upgrading immediately is not possible, the following mitigations can reduce exposure:Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges).Deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required.Monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.For More InformationIf you have any questions or concerns about this advisory, please contact us at:Email us at [security@fleetdm.com](mailto:security@fleetdm.com)CreditsWe thank @fuzzztf for responsibly reporting this issue.
CVSS v4.0: 8.7
GHSA-2888-q29x-2g3p: A man in the middle can redirect traffic to a malicious server in a compromised configuration.
CVSS v3.1: 5.4
GHSA-fg2c-cfr9-9gw3: A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to application crash and other consequences.
CVSS v3.1: 7.8
CVE-2023-2221: WP Custom Cursors < 3.2 - Admin+ SQLi
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
CVSS v3.1: 7.2
GHSA-qvx7-6mf9-vg7p: SQL injection vulnerability in Badger Meter Monitool affecting versions 4.6.3 and earlier. A remote attacker could send a specially crafted SQL query to the server via the j_username parameter and retrieve the information stored in the database.
CVSS v3.1: 9.8
GHSA-74f7-fgmv-4c5m: On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings.
CVSS v3.1: 6.5
GHSA-r7j9-2qv5-fpm9: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
CVSS v3.1: 9.8
CVE-2025-40897: Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.
CVSS v4.0: 7.2
CVSS v3.1: 8.1
GHSA-gr8x-chfr-hp52: WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with .inc extensions from the web root.
GHSA-2x32-fffh-53mr: KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.
CVSS v3.0: 7.8
CVE-2019-19162: A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.
CVSS v3.1: 7.8
GHSA-w48c-h4fc-5xvq: An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages.
CVSS v3.0: 6.5
CVE-2022-29429: WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerability
Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.
CVSS v3.1: 8.8
CVE-2010-4544: Cross-site scripting (XSS) vulnerability in the servlet in IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-6gfm-xgpv-xhqf: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, 9.0.4.2, and 10.1.2.0.0 has unknown impact and attack vectors, aka Oracle Vuln# (1) AS05 and (2) AS08.
GHSA-r77x-jc2c-73vx: Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description.  NOTE: some of these details are obtained from third party information.
CVE-2024-43481: Power BI Report Server Spoofing Vulnerability
Power BI Report Server Spoofing Vulnerability
CVSS v3.1: 6.5
GHSA-52w9-qfc2-5xq5: The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
CVSS v3.1: 9.8
CVE-2004-0310: Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url.
CVSS v2.0: 6.8
CVE-2007-3333: Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control sequences.
CVSS v2.0: 6.9
GHSA-8ww6-w8fm-v567: Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values.
GHSA-vrv9-ccj3-g284: Jenkins IRC Plugin stores credentials in plain text
Jenkins IRC Plugin stores credentials unencrypted in its global configuration file `hudson.plugins.ircbot.IrcPublisher.xml` on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
CVSS v3.0: 3.3
CVE-1999-1385: Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable.
CVSS v2.0: 7.2
CVE-2016-7931: The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print().
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-v97q-8h6v-ffr3: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.
GHSA-87x7-hf6q-h4h9: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
CVSS v3.1: 7.8
CVE-2025-31059: WordPress WBW Product Table PRO plugin <= 2.2.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Product Table PRO woo-producttables-pro allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through <= 2.2.6.
CVSS v3.1: 9.3
CVE-2016-0892: Cross-site scripting (XSS) vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-3435-g6fx-jc4p: The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
CVSS v3.1: 7.5
CVE-2020-14734: Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Text. Successful attacks of this vulnerability can result in takeover of Oracle Text. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 8.1
GHSA-6gfh-6c5f-fx83: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.
RHSA-2013:0124: Red Hat Security Advisory: net-snmp security and bug fix update
net-snmp: Array index error, leading to out-of heap-based buffer read (snmpd crash)
CVE-2024-27309: Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.

Two preconditions are needed to trigger the bug:
1. The administrator decides to remove an ACL
2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.

When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.

The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).

The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
CVSS v3.1: 7.4
GHSA-v52h-vg9v-g8p5: , aka 'Windows GDI+ Information Disclosure Vulnerability'.
CVSS v3.1: 5.5
GHSA-3776-639q-72wg: BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.
CVE-2001-1171: Check Point Firewall-1 3.0b through 4.0 SP1 follows symlinks and creates a world-writable temporary .cpp file when compiling Policy rules, which could allow local users to gain privileges or modify the firewall policy.
CVSS v2.0: 7.2
CVE-2025-70982: Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.
CVSS v3.1: 9.9
CVE-2022-30256: An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.
CVSS v3.1: 7.5
GHSA-7x3c-rhf7-6h79: Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.
GHSA-7h5w-jxqm-62j3: Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save.
CVSS v3.0: 6.1
CVE-2024-10250: Nioland <= 1.2.6 - Reflected Cross-Site Scripting via s
The Nioland theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2022-41050: Windows Extensible File Allocation Table Elevation of Privilege Vulnerability
Windows Extensible File Allocation Table Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2015-1129: Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.
CVSS v2.0: 4.3
GHSA-pxqg-3p4m-pvq9: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter.
CVSS v3.1: 7.5