ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-9jc7-qcx3-x7m2: Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
CVSS v3.0: 6.1
GHSA-j6gf-pxm2-h6x5: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.
CVSS v3.1: 5.5
GHSA-cp27-4mp6-x55r: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes allows Stored XSS.This issue affects Kodex Posts likes: from n/a through 2.5.0.
CVSS v3.1: 5.9
GHSA-whxq-h93c-wvrx: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 6.3
GHSA-mrwx-544j-6wp3: Stack-based buffer overflow in CA BrightStor ARCserve Backup R11.5 client and server allows remote attackers to execute arbitrary code via long messages to the CheyenneDS Mailslot.
CVE-2018-0309: A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone NX-OS mode) on Cisco Nexus 3000 and 9000 Series Switches could allow an authenticated, remote attacker to exhaust system memory on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to the incorrect implementation of the CLI command, resulting in a failure to free all allocated memory upon completion. An attacker could exploit this vulnerability by authenticating to the affected device and repeatedly issuing a specific CLI command or sending a specific SNMP poll request for a specific Object Identifier (OID). A successful exploit could allow the attacker to cause the IP routing process to restart or to cause a device reset, resulting in a DoS condition. Cisco Bug IDs: CSCvf23136.
CVSS v3.0: 7.7
CVSS v2.0: 6.8
CVE-2016-6613: An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS v3.0: 5.3
CVSS v2.0: 2.1
CVE-2024-37989: Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 8
GHSA-f2xw-w9gh-q2h9: Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image.The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.
CVSS v3.0: 9.8
GHSA-rqxc-9p8h-xqgq: Duplicate Advisory: ActiveAdmin vulnerable to CSV injection
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-xhvv-3jww-c487. This link is maintained to preserve external references.Original Descriptioncsv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.
CVSS v3.1: 8.4
GHSA-38gp-wr3c-cqw7: cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
CVSS v3.0: 3.3
CVE-2010-4917: SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL commands via the words parameter.
CVSS v2.0: 7.5
CVE-2026-23977: WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.2.
CVSS v3.1: 7.5
GHSA-gf4w-c435-pq7v: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file.
CVSS v3.0: 7.8
CVE-2021-2461: Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications (component: Provision API). The supported version that is affected is 6.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Interactive Session Recorder. While the vulnerability is in Oracle Communications Interactive Session Recorder, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Interactive Session Recorder accessible data as well as unauthorized read access to a subset of Oracle Communications Interactive Session Recorder accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Interactive Session Recorder. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).
CVSS v3.1: 8.3
GHSA-rw5g-57c7-74m2: OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2015-6848: EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
CVSS v2.0: 8.5
CVE-2017-14865: There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2023-4849: IBOS OA trash&op=del sql injection
A vulnerability, which was classified as critical, has been found in IBOS OA 4.5.5. Affected by this issue is some unknown functionality of the file ?r=file/dashboard/trash&op=del. The manipulation of the argument fids leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239258 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2010-1604: Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute arbitrary SQL commands via the (1) user parameter (aka login field) and (2) passwd parameter (aka password field).  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
GHSA-m5x7-2x5r-8m3f: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.
CVSS v3.1: 9.8
CVE-2021-36889: WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
CVSS v3.1: 3.4
CVE-2023-53078: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32):
  comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............
  backtrace:
    [<0000000098f3a26d>] alua_activate+0xb0/0x320
    [<000000003b529641>] scsi_dh_activate+0xb2/0x140
    [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
    [<000000007adc9ace>] process_one_work+0x3c5/0x730
    [<00000000c457a985>] worker_thread+0x93/0x650
    [<00000000cb80e628>] kthread+0x1ba/0x210
    [<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.
CVSS v3.1: 5.5
CVE-2022-50225: riscv:uprobe fix SR_SPIE set/clear handling
In the Linux kernel, the following vulnerability has been resolved:

riscv:uprobe fix SR_SPIE set/clear handling

In riscv the process of uprobe going to clear spie before exec
the origin insn,and set spie after that.But When access the page
which origin insn has been placed a page fault may happen and
irq was disabled in arch_uprobe_pre_xol function,It cause a WARN
as follows.
There is no need to clear/set spie in arch_uprobe_pre/post/abort_xol.
We can just remove it.

[   31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488
[   31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work
[   31.684929] preempt_count: 0, expected: 0
[   31.685969] CPU: 2 PID: 76 Comm: work Tainted: G
[   31.686542] Hardware name: riscv-virtio,qemu (DT)
[   31.686797] Call Trace:
[   31.687053] [<ffffffff80006442>] dump_backtrace+0x30/0x38
[   31.687699] [<ffffffff80812118>] show_stack+0x40/0x4c
[   31.688141] [<ffffffff8081817a>] dump_stack_lvl+0x44/0x5c
[   31.688396] [<ffffffff808181aa>] dump_stack+0x18/0x20
[   31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122
[   31.688948] [<ffffffff8003e4b2>] __might_sleep+0x50/0x7a
[   31.689435] [<ffffffff80822676>] down_read+0x30/0x130
[   31.689728] [<ffffffff8000b650>] do_page_fault+0x166/x446
[   31.689997] [<ffffffff80003c0c>] ret_from_exception+0x0/0xc
CVSS v3.1: 5.5
RHSA-2018:0676: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
kernel: unlimiting the stack disables ASLR kernel: media: use-after-free in [tuner-xc2028] media driver kernel: Buffer overflow in firewire driver via crafted incoming packets kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() kernel: Use-after-free vulnerability in DCCP socket kernel: Incorrect type conversion for size during dma allocation Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register kernel: memory leak when merging buffers in SCSI IO vectors kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker kernel: Missing permission check in move_pages system call kernel: Null pointer dereference in rngapi_reset function kernel: vfs: BUG in truncate_inode_pages_range() and fuse client kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c kernel: net: double-free and memory corruption in get_net_ns_by_id() kernel: Use-after-free in snd_seq_ioctl_create_port() kernel: dereferencing NULL payload with nonzero length kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ Kernel: KVM: DoS via write flood to I/O port 0x80 kernel: Stack information leak in the EFS element kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact kernel: Race condition in sound system can lead to denial of service
CVSS v3.0: 4.7
GHSA-c983-r7vq-6347: Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permission of table management may obtain and/or alter the information of the unauthorized table.
CVSS v3.0: 3.8
GHSA-w66g-pq85-j4vq: A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
CVSS v3.0: 6.1
CVE-2012-3175: Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518.
CVSS v2.0: 4.3
CVE-2021-42988: Eltima USB Network Gate is affected by Buffer Overflow. IOCTL Handler 0x22001B in the USB Network Gate above 7.0.1370 below 9.2.2420 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS v3.1: 8.8
CVSS v2.0: 7.2
CVE-2018-1000037: In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafted file.
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2025-60876: BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVSS v3.1: 6.5
CVE-2010-5254: Untrusted search path vulnerability in GFI Backup 3.1 Build 20100730 2009 Home Edition allows local users to gain privileges via a Trojan horse ArmAccess.dll file in the current working directory, as demonstrated by a directory that contains a .gbc or .gbt file.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.9
GHSA-gchf-frc2-7ccg: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
GHSA-v4mw-26wf-pfx6: A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters.
CVSS v3.0: 9.8
CVE-2015-0387: Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to Security - LDAP Security Adapter.
CVSS v2.0: 4
GHSA-rfr4-3g5m-pj38: Unspecified vulnerability in a web page in the PRM module in Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
GHSA-gq9p-fgf8-xxr3: A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. Tianyi Gateway is a hardware terminal of "Optical Modem Smart Router." Attackers can use this vulnerability to restart the device multiple times.
GHSA-78gp-vpc9-g8ph: Missing Authorization vulnerability in Dariolee Netease Music allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Netease Music: from n/a through 3.2.1.
CVSS v3.1: 4.3
CVE-2007-3380: The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service.
CVSS v2.0: 5
GHSA-q5jq-r8c6-hm6v: An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
CVSS v3.0: 9.8
CVE-2020-5612: Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2006-6564: FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, which results in a NULL pointer dereference.  NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
CVSS v2.0: 4
CVE-2006-2027: Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite, probably 3.0, allows remote authenticated users to execute arbitrary code by sending a command with a long argument, which triggers a buffer overflow when an admin selects the Logging section in the FTP server main window.  NOTE: the original researcher claims that the vendor disputes this issue.
CVSS v2.0: 6.5
CVE-2014-3069: Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters.
CVSS v2.0: 3.5
CVE-2025-23747: WordPress Awesome Timeline plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.
CVSS v3.1: 6.5
CVE-2025-22592: WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
CVSS v3.1: 7.5
GHSA-hj7q-vpxf-qv3v: TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.
CVE-2013-4597: The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS v2.0: 4
GHSA-vcw3-69r6-3w2m: A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
CVSS v3.1: 6.1
RHSA-2024:2933: Red Hat Security Advisory: logging for Red Hat OpenShift security update
golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
CVSS v3.1: 7.5
CVE-2013-1565: Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.11 allows remote attackers to affect availability via unknown vectors.
CVSS v2.0: 5
GHSA-573w-86fx-gf5p: An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
CVSS v3.1: 8.1
RHSA-2022:5482: Red Hat Security Advisory: thunderbird security update
Mozilla: Undesired attributes could be set as part of prototype pollution Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid Mozilla: CSP bypass enabling stylesheet injection Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI Mozilla: Use-after-free in nsSHistory Mozilla: Unavailable PAC file resulted in OCSP requests being blocked Mozilla: A popup window could be resized in a way to overlay the address bar with web content Mozilla: Potential integer overflow in ReplaceElementsAt Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
CVSS v3.1: 8.8
CVSS v3.0: 7.5
GHSA-3pf8-v7f6-5947: Cross-Site Request Forgery (CSRF) vulnerability in Michael Cannon Custom Bulk/Quick Edit allows Cross Site Request Forgery. This issue affects Custom Bulk/Quick Edit: from n/a through 1.6.10.
CVSS v3.1: 4.3
CVE-2023-42745: In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVSS v3.1: 7.8
CVE-2010-1422: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle changes to keyboard focus that occur during processing of key press events, which allows remote attackers to force arbitrary key presses via a crafted HTML document.
CVSS v2.0: 4.3
CVE-2005-3950: nuauth in NuFW 1.0.x before 1.0.16 and 1.1 allows authenticated users to cause a denial of service via malformed packets.
CVSS v2.0: 6.8
CVE-2025-36225: IBM Aspera Faspex information disclosure
IBM Aspera 5.0.0 through 5.0.13.1 

could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
CVSS v3.1: 4.3
CVE-2019-3947: Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.
CVSS v3.0: 9.8
CVSS v2.0: 5
GHSA-h59m-4c8p-qx63: The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
CVE-2018-16854: A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
CVSS v3.0: 6.5
CVE-2021-22981: On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS v3.1: 4.8
CVSS v2.0: 5.8