ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-jqq4-c7wq-36h7: risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
Arbitrary code execution in guest via memory safety failure in `sys_read`In affected versions of `risc0-zkvm-platform`, when the zkVM guest calls `sys_read`, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As `sys_read` is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program.A fix was applied in [\#3351](https://github.com/risc0/risc0/pull/3351). The vulnerable pointer arithmetic was removed, and replaced with a simplified implementation in the `v1compat` kernel which uses Rust’s slice functions to guarantee memory safety.The fix has been released as part of `risc0-zkvm` versions `2.3.2` and `3.0.3`. All prior versions are affected.RemediationAll developers of zkVM applications should update their guests to use `risc0-zkvm` versions `^2.3.2` or `^3.0.3`.This upgrade can be accomplished by editing all `Cargo.toml` files in the following way.Any references to [`risc0-zkvm`](https://crates.io/crates/risc0-zkvm) should use version specifiers `”2.3.2”` or `”3.0.3”`.Any references to [`risc0-build`](https://crates.io/crates/risc0-build) should use version specifiers `”2.3.2”` or `”3.0.3”`, matching `risc0-zkvm`.Any references to [`risc0-zkvm-platform`](https://crates.io/crates/risc0-zkvm-platform) should use version specifier `”2.1.0”` or later. Most projects will not have direct references to this crate.Rebuild your application including the guest. You can run the following command to check that the patch is applied:Any applications that use the image ID of this guest need to be updated with the newly built image ID.Note that there are no changes to the RISC Zero proof system or circuits. Provers are not required to take any action. Users of the Groth16 smart contract verifier and the [RISC Zero Verifier Router](https://dev.risczero.com/api/blockchain-integration/contracts/verifier#verifier-router) are not required to take any action beyond updating their guest programs.Any applications using the `risc0-aggregation` crate or the `RiscZeroSetVerifier` smart contract should update to version `>=0.9`. This application includes a zkVM guest, which is vulnerable in versions prior to `0.9`. Instances of the `RiscZeroSetVerifier` operated by RISC Zero have been disabled via the estop mechanism outlined in the [Verifier Management Design](https://github.com/risc0/risc0-ethereum/blob/release-2.0/contracts/version-management-design.md#base-verifier-implementations).
CVSS v4.0: 9.3
CVE-2010-1989: Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images, a related issue to CVE-2010-0181.
CVSS v2.0: 5
GHSA-9j55-g998-6v4p: An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
CVSS v3.1: 5.9
GHSA-fj2c-82j7-pvqx: Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation.
CVSS v3.0: 9.8
GHSA-hwcc-4cv8-cf3h: Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
IssueSnowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in [version 2.1.5](https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023).Attack ScenarioSnowflake uses CRL to check if a TLS certificate has been revoked before its expiration date. The lack of correct validation of revoked certificates could, in theory, allow an attacker who has both access to the private key of a correctly issued Snowflake certificate and the ability to intercept network traffic to perform a Man-in-the-Middle (MitM) attack in order to compromise Snowflake credentials used by the driver.The vulnerability is difficult to exploit given both conditions required and, at the time of this advisory's publication, Snowflake is not aware of any compromise of its certificates, nor unauthorized issuance of such by any publicly trusted Certificate Authority (CA). However, an upgrade to the newest version is recommended to ensure the highest level of security and protection against future unforeseen threats.SolutionOn December 18, 2023, Snowflake released [version 2.1.5](https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023) of the Snowflake Connector .NET, which fixes the issue, and we recommend users upgrade to [version 2.1.5](https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023).  Customers continuing to use the impacted versions of the connector should update their insecureMode flag to true.AcknowledgementSnowflake would like to thank [Timo Vink](https://github.com/TimoVink) for reporting this vulnerability.Additional InformationIf you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
CVSS v3.1: 6
CVE-2010-0485: The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 "do not properly validate all callback parameters when creating a new window," which allows local users to execute arbitrary code, aka "Win32k Window Creation Vulnerability."
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-jgq3-jm34-rx5m: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15. An attacker with physical access to a device may be able to read contact numbers from the lock screen.
CVSS v3.1: 2.4
CVE-2025-37130: Unrestricted Binary allows File Enumeration in Underlying Operating  System
A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.
CVSS v3.1: 6.5
CVE-2010-4521: Cross-site scripting (XSS) vulnerability in the Views module 6.x before 6.x-2.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via a page path.
CVSS v2.0: 4.3
CVE-2023-35067: Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval System
Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable.

This issue affects E-Invoice Approval System: before v.20230701.
CVSS v3.1: 7.5
GHSA-86mg-57gh-5q24: An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.
CVSS v3.0: 8.8
CVE-2025-21354: Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
CVSS v3.1: 8.4
CVE-2022-24108: The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-c72v-cfc9-xq8m: A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS v3.1: 7.1
CVE-2005-0380: Multiple PHP remote file inclusion vulnerabilities in (1) print_category.php, (2) login.php, (3) setup.php, (4) ask_password.php, or (5) error.php in ZeroBoard 4.1pl5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the dir parameter to reference a URL on a remote web server that contains the code.
CVSS v2.0: 7.5
CVE-2019-0959: Windows Common Log File System Driver Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.
The security update addresses the vulnerability by correcting how CLFS handles objects in memory.
CVSS v3.1: 7
GHSA-hx3v-wmpr-r7fv: The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
CVSS v3.0: 5.4
RHSA-2012:1589: Red Hat Security Advisory: kernel security and bug fix update
kernel: unfiltered netdev rio_ioctl access by users
GHSA-grg9-5jg7-hgw6: Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due to insecure default configuration setting for the embedded MySQL database.
CVSS v3.0: 6.5
CVE-2021-42575: The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2022-45527: File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the courseimg directory.
CVSS v3.1: 9.8
CVE-2017-0535: An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33547247.
CVSS v3.0: 4.7
CVSS v2.0: 2.6
RHSA-2021:4039: Red Hat Security Advisory: devtoolset-10-gcc security update
environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
CVSS v3.1: 8.5
CVE-2022-36277: SQL injection vulnerability in TCMAN GIM
The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks.
CVSS v3.1: 6.5
CVE-2026-44859: Authenticated Stack-Based Buffer Overflow in PAPI Services
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS v3.1: 7.2
GHSA-pjp4-mc9j-frh7: Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter.  NOTE: this issue can be leveraged to obtain full path information in error messages.
CVE-2019-9628: The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2025-23681: WordPress REDIRECTION PLUS plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.
CVSS v3.1: 7.1
GHSA-vr2h-fpfm-62g7: CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.
CVSS v4.0: 7.3
GHSA-fv4p-hrvc-c34g: tap-windows6 driver version 9.26 and earlier does not properly 
check the size data of incomming write operations which an attacker can 
use to overflow memory buffers, resulting in a bug check and potentially
 arbitrary code execution in kernel space
CVSS v3.1: 9.8
GHSA-6398-wx75-gg5p: ezRADIUS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for (1) config.ini or (2) database.ini.  NOTE: some of these details are obtained from third party information.
GHSA-h836-vcx3-ff7v: In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission overload. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 4.4
GHSA-c8xf-mfg5-fp93: Directory traversal vulnerability in the web interface on Foscam devices with firmware before 11.37.2.49 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by discovering (1) web credentials or (2) Wi-Fi credentials.
GHSA-vx2g-v3f9-m6mw: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function.
CVSS v3.1: 9.8
GHSA-5cpj-j8xh-5rgh: A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device.This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
CVSS v3.1: 8.6
GHSA-4rgw-cq58-c8v4: admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.
CVSS v3.0: 6.1
GHSA-7hf7-68wx-vrmr: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
GHSA-hrvw-8ffp-h56x: Heap-based buffer overflow in the goim handler of AOL Instant Messenger (AIM) 4.4 through 4.8.2616 allows remote attackers to cause a denial of service (crash) via escaping of the screen name parameter, which triggers the overflow when the user selects "Get Info" on the buddy.
GHSA-ph2g-q2qh-xjp9: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6158, CVE-2015-6159, and CVE-2015-6160.
CVE-2023-52584: spmi: mediatek: Fix UAF on device remove
In the Linux kernel, the following vulnerability has been resolved:

spmi: mediatek: Fix UAF on device remove

The pmif driver data that contains the clocks is allocated along with
spmi_controller.
On device remove, spmi_controller will be freed first, and then devres
, including the clocks, will be cleanup.
This leads to UAF because putting the clocks will access the clocks in
the pmif driver data, which is already freed along with spmi_controller.

This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and
building the kernel with KASAN.

Fix the UAF issue by using unmanaged clk_bulk_get() and putting the
clocks before freeing spmi_controller.
CVSS v3.1: 3.8
GHSA-6cgp-hmjx-r8fx: MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper privileges, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2025-32052: Libsoup: heap buffer overflow in sniff_unknown()
A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.
CVSS v3.1: 6.5
CVE-2022-49406: block: Fix potential deadlock in blk_ia_range_sysfs_show()
In the Linux kernel, the following vulnerability has been resolved:

block: Fix potential deadlock in blk_ia_range_sysfs_show()

When being read, a sysfs attribute is already protected against removal
with the kobject node active reference counter. As a result, in
blk_ia_range_sysfs_show(), there is no need to take the queue sysfs
lock when reading the value of a range attribute. Using the queue sysfs
lock in this function creates a potential deadlock situation with the
disk removal, something that a lockdep signals with a splat when the
device is removed:

[  760.703551]  Possible unsafe locking scenario:
[  760.703551]
[  760.703554]        CPU0                    CPU1
[  760.703556]        ----                    ----
[  760.703558]   lock(&q->sysfs_lock);
[  760.703565]                                lock(kn->active#385);
[  760.703573]                                lock(&q->sysfs_lock);
[  760.703579]   lock(kn->active#385);
[  760.703587]
[  760.703587]  *** DEADLOCK ***

Solve this by removing the mutex_lock()/mutex_unlock() calls from
blk_ia_range_sysfs_show().
CVSS v3.1: 5.5
CVE-2022-22481: IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials. By modifying the sign on request, an attacker can gain visibility to the fully qualified domain name of the target system and the navigator tasks page, however they do not gain the ability to perform those tasks on the system or see any specific system data. IBM X-Force ID: 225899.
CVSS v3.0: 3.7
GHSA-fwmj-g364-qxmg: IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
CVSS v3.0: 9.8
PYSEC-2020-147: TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
CVE-2020-35951: An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).
CVSS v3.1: 9.9
GHSA-rxmv-m4hq-5fh4: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3) APPS10 in the (c) Oracle General Ledger component; (4) APPS12 and (5) APPS13 in the (d) Oracle Receivables component.
GHSA-5g73-69p4-7gvx: Code execution in pandasai
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
CVSS v3.1: 9.8
CVE-2025-24085: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
CVSS v3.1: 10
CVE-2012-5878: Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-pq37-mvgc-px93: Improper privilege management in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
CVSS v3.1: 6.7
GHSA-hpp6-2prw-cvwr: A vulnerability, which was classified as problematic, was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.
CVSS v3.1: 2.7
RHSA-2021:3177: Red Hat Security Advisory: cloud-init security update
cloud-init: randomly generated passwords logged in clear-text to world-readable file
CVSS v3.1: 5.5
RHSA-2026:19373: Red Hat Security Advisory: dnsmasq security update
dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion dnsmasq: NSEC bitmap parsing infinite loop dnsmasq: RRSIG rdlen underflow leading to heap OOB read dnsmasq: DHCPv6 CLID buffer overflow in helper process dnsmasq: Broken ECS source validation bypass
CVSS v3.1: 6.5
CVE-2020-2843: Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.0: 8.2
CVE-2012-6432: Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
CVSS v2.0: 6.8
RHSA-2008:1021: Red Hat Security Advisory: enscript security update
enscript: "setfilename" special escape buffer overflow enscript: "font" special escape buffer overflows enscript: "epsf" special escape buffer overflows