ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-qg89-qwwh-5f3j: SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
ResolutionSillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.Documentation:https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelistinghttps://docs.sillytavern.app/administration/#security-checklistNote on future SSRF findingsSince the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.SummarySillyTavern 1.17.0 exposes `/api/search/searxng`, which accepts attacker-controlled `baseUrl` and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point `baseUrl` at an internal or loopback HTTP service and receive the `/search` response body.Confirmed version: SillyTavern 1.17.0 from the audited source tree. Broader affected versions and patched versions should be confirmed by the maintainer.DetailsThe `/api/search/searxng` route in `src/endpoints/search.js` reads `baseUrl` from `request.body` and performs no allowlist, IP range, DNS, or scheme validation before making outbound requests.Core vulnerable path:`src/server-startup.js` mounts this router at `/api/search`, and `src/server-main.js` applies login middleware before the API routes. This means the source is a remote authenticated POST request and the sink is server-side `fetch()` to attacker-selected hosts.PoCAttacker prerequisites: a valid SillyTavern web session, or access to a deployment where user accounts are disabled.Start an internal mock service on the target host:Then send:Result based on the route logic: SillyTavern first fetches `http://127.0.0.1:9091/`, then fetches `http://127.0.0.1:9091/search?q=x`, and returns `INTERNAL-SEARCH-RESULT` to the attacker.ImpactThis is an authenticated SSRF primitive with arbitrary host and port selection. It can disclose responses from loopback or internal HTTP services reachable from the SillyTavern host and may enable interaction with internal admin panels, development services, cloud metadata endpoints in applicable deployments, or service discovery across private networks.
CVSS v3.1: 8.5
GHSA-6wxp-8624-h2hh: A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 6.3
GHSA-cc56-qj68-r3m7: An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.
CVSS v3.0: 9.8
GHSA-q88h-gvfq-84pc: In the Linux kernel, the following vulnerability has been resolved:iommu/mediatek: Remove clk_disable in mtk_iommu_removeAfter the commit b34ea31fe013 ("iommu/mediatek: Always enable the clk on
resume"), the iommu clock is controlled by the runtime callback.
thus remove the clk control in the mtk_iommu_remove.Otherwise, it will warning like:echo 14018000.iommu > /sys/bus/platform/drivers/mtk-iommu/unbind[   51.413044] ------------[ cut here ]------------
[   51.413648] vpp0_smi_iommu already disabled
[   51.414233] WARNING: CPU: 2 PID: 157 at */v5.15-rc1/kernel/mediatek/
                          drivers/clk/clk.c:952 clk_core_disable+0xb0/0xb8
[   51.417174] Hardware name: MT8195V/C(ENG) (DT)
[   51.418635] pc : clk_core_disable+0xb0/0xb8
[   51.419177] lr : clk_core_disable+0xb0/0xb8
...
[   51.429375] Call trace:
[   51.429694]  clk_core_disable+0xb0/0xb8
[   51.430193]  clk_core_disable_lock+0x24/0x40
[   51.430745]  clk_disable+0x20/0x30
[   51.431189]  mtk_iommu_remove+0x58/0x118
[   51.431705]  platform_remove+0x28/0x60
[   51.432197]  device_release_driver_internal+0x110/0x1f0
[   51.432873]  device_driver_detach+0x18/0x28
[   51.433418]  unbind_store+0xd4/0x108
[   51.433886]  drv_attr_store+0x24/0x38
[   51.434363]  sysfs_kf_write+0x40/0x58
[   51.434843]  kernfs_fop_write_iter+0x164/0x1e0
CVSS v3.1: 5.5
CVE-2024-37954: WordPress Simple Responsive Slider plugin <= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in marcelotorres Simple Responsive Slider allows Reflected XSS.This issue affects Simple Responsive Slider: from n/a through 0.2.2.5.
CVSS v3.1: 7.1
CVE-2017-10175: Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Profiles). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-vvp6-473x-332g: In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
CVSS v3.1: 6.5
RHSA-2025:9696: Red Hat Security Advisory: apache-commons-beanutils security update
commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
CVSS v3.1: 8.8
CVE-2016-5731: Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2021-30303: Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS v3.1: 7.8
GHSA-g2fm-x3cp-mqw9: Cross-site Scripting in Apache NiFi
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
CVSS v3.0: 5.4
RHSA-2022:8917: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.1 release and security update
openssl: c_rehash script allows command injection openssl: the c_rehash script allows command injection
CVSS v3.1: 6.7
CVE-2015-6134: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6141.
CVSS v2.0: 9.3
GHSA-x828-wp24-7h9m: Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-hw49-57p9-2mh2: There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.
CVSS v3.1: 7.2
GHSA-wv94-3p8w-fgm3: A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. Cisco has not released software updates that address this vulnerability. This vulnerability affects Cisco Small Business SPA514G IP Phones that are running firmware release 7.6.2SR2 or earlier.
CVSS v3.0: 7.5
CVE-2020-12679: A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
RHSA-2024:8870: Red Hat Security Advisory: kernel-rt security update
kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; kernel: bpf: Fix overrunning reservations in ringbuf kernel: netfilter: nf_tables: prefer nft_chain_validate kernel: ibmvnic: Add tx check to prevent skb leak kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers kernel: drm/amdgpu: avoid using null object of framebuffer kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush kernel: USB: serial: mos7840: fix crash on resume kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error kernel: kobject_uevent: Fix OOB access within zap_modalias_env() kernel: dev/parport: fix the array out-of-bounds risk kernel: block: initialize integrity buffer to zero before writing it to media kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() kernel: memcg: protect concurrent access to mem_cgroup_idr kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). kernel: bonding: fix xfrm real_dev null pointer dereference kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok kernel: netfilter: flowtable: initialise extack before use kernel: ELF: fix kernel.randomize_va_space double read kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
CVSS v3.1: 4.7
GHSA-f8wv-9r86-v5m3: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the fd allocated during the get_metadata was not closed even though the buffer allocated to the fd was freed. This resulted in a failure during exit sequence.
CVSS v3.0: 7.8
PYSEC-2021-58: sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1.
GHSA-w52v-m35r-23vm: An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.
CVSS v3.0: 8.8
GHSA-pwwp-m5v6-r3p7: A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the component SqlTool. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-w79w-69fh-fq49: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.
CVSS v3.1: 8.5
GHSA-473q-p3cq-866g: ** UNSUPPORTED WHEN ASSIGNED ** A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service via a specially crafted HTTP packet.
CVSS v3.1: 7.5
GHSA-w3cw-f63h-9g34: Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability affects Firefox for iOS < 144.0.
CVSS v3.1: 6.5
GHSA-5prg-69vq-2qg9: The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.
CVE-2021-26580: A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO Amplifier Pack 1.95 or later.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-wp2x-3263-phvm: Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages incorrect handling of objects in memory, aka "Kernel Race Condition Vulnerability," a different vulnerability than CVE-2013-1278.
GHSA-w53q-r6vc-pxr9: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVE-2009-1304: The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving (1) js_FindPropertyHelper, related to the definitions of Math and Date; and (2) js_CheckRedeclaration.
CVSS v2.0: 5
CVE-2016-3647: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request.
CVSS v3.0: 7.7
CVSS v2.0: 4
GHSA-w9x7-rc5r-7v58: Cross-Site Request Forgery (CSRF) vulnerability in César Martín TOCHAT.BE allows Cross Site Request Forgery. This issue affects TOCHAT.BE: from n/a through 1.3.4.
CVSS v3.1: 4.3
RHSA-2023:0192: Red Hat Security Advisory: java-17-openjdk security and bug fix update
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) OpenJDK: soundbank URL remote loading (Sound, 8293742)
CVSS v3.1: 3.7
GHSA-8j34-9cp8-62rj: Multiple untrusted search path vulnerabilities in ACDSee Photo Editor 2008 5.x build 291 allow local users to gain privileges via a Trojan horse (1) Wintab32.dll or (2) CV11-DialogEditor.dll file in the current working directory, as demonstrated by a directory that contains a .apd file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2005-4334: SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter to (1) zixforum/forum.asp, as used in (2) Headforums.asp and (3) Subject.asp.
CVSS v2.0: 7.5
CVE-2016-8744: Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-mj69-3r69-43wq: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls.  IBM X-Force ID:  254658.
CVSS v3.1: 8.4
RHSA-2025:19017: Red Hat Security Advisory: OpenShift Container Platform 4.16.51 bug fix and security update
dompurify: DOMPurify vulnerable to tampering by prototype pollution
CVSS v3.1: 8.2
GHSA-3j7r-r9wv-qrjp: Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with root level access to either the vApp or containerized versions of Cloud Mobility may potentially exploit this vulnerability, leading to the modification or deletion of tables that are required for many of the core functionalities of Cloud Mobility. Exploitation may lead to the compromise of integrity and availability of the normal functionality of the Cloud Mobility application.
CVSS v3.1: 6.7
GHSA-rxj3-46h2-hcx7: The Grasshopper Beta (aka com.grasshopper.dialer) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
RHSA-2024:2973: Red Hat Security Advisory: libX11 security update
libX11: out-of-bounds memory access in _XkbReadKeySyms() libX11: stack exhaustion from infinite recursion in PutSubImage() libX11: integer overflow in XCreateImage() leading to a heap overflow
CVSS v3.1: 7.8
GHSA-vmp8-hjpw-vp73: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.
CVSS v3.1: 7.1
GHSA-m68j-36qf-qjg5: Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arbitrary SQL commands via (1) the password field to login.php, (2) the login field (aka email parameter) to login.php, (3) the password field (aka pass parameter) to the default URI under admin/, and possibly (4) the login field to the default URI under admin/.  NOTE: some of these details are obtained from third party information.
GHSA-mjjv-h2rr-wqh2: Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
GHSA-x8jx-g9qm-xr7m: The note-press plugin before 0.1.2 for WordPress has SQL injection.
CVE-2019-19562: An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information.
CVSS v3.1: 4.6
CVSS v2.0: 2.1
GHSA-f796-mwxc-3vc9: The perf subsystem in the kernel package 2.6.32-122.el6.x86_64 in Red Hat Enterprise Linux (RHEL) 6 does not properly handle NMIs, which might allow local users to cause a denial of service (excessive log messages) via unspecified vectors.
GHSA-286g-52x6-9289: Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVE-2023-4401: 

Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access.


CVSS v3.1: 7.8
CVE-2025-7365: Keycloak: phishing attack via email verification step in first login flow
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.
CVSS v3.1: 7.1
CVE-2025-57573: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi.
CVSS v3.1: 5.6