ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-37896: Nuclei Path Traversal vulnerability
Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. There was a potential risk with payloads loading in sandbox mode. The issue occurred due to relative paths not being converted to absolute paths before doing the check for `sandbox` flag allowing arbitrary files to be read on the filesystem in certain cases when using Nuclei from `Go` SDK implementation. 

This issue has been fixed in version 2.9.9. The maintainers have also enabled sandbox by default for filesystem loading. This can be optionally disabled if required. The `-sandbox` option has been deprecated and is now divided into two new options: `-lfa` (allow local file access) which is enabled by default and `-lna` (restrict local network access) which can be enabled by users optionally. The `-lfa` allows file (payload) access anywhere on the system (disabling sandbox effectively), and `-lna` blocks connections to the local/private network.
CVSS v3.1: 7.5
GHSA-56hx-88qj-8268: Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.
CVSS v3.1: 5.3
GHSA-r68c-v3gr-w2rh: ** DISPUTED **  Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MASK environment variable value.  NOTE: the glibc maintainers state that they do not believe that this issue is exploitable for code execution.
CVE-2017-1002006: Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
CVSS v3.0: 7.5
CVSS v2.0: 5
RHSA-2025:3358: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update
narayana: deadlock via multiple join requests sent to LRA Coordinator netty: Denial of Service attack on windows app using Netty io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine netty: Denial of Service attack on windows app using Netty
CVSS v3.1: 5.5
GHSA-r375-22x8-pwjm: Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs.
GHSA-j5g5-c424-7xqg: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
CVSS v3.1: 7
GHSA-rfp4-h3mc-c4hv: Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
CVSS v3.1: 4.3
GHSA-h3gx-q82j-vhq3: Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.
CVE-2023-33868: PiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts



The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.




CVSS v3.1: 5.9
GHSA-4fcg-8qj5-c5j2: MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.
CVSS v3.0: 6.1
CVE-2023-21597: Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2022-27241: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.11), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.12). Applications built with an affected system publicly expose the internal project structure. This could allow an unauthenticated remote attacker to read confidential information.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-mff2-83j6-4xq7: Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.98 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
RHSA-2016:1858: Red Hat Security Advisory: ruby193-rubygem-actionpack security update
rubygem-actionview: cross-site scripting flaw in Action View
CVSS v3.0: 6.1
RHSA-2022:7273: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.0 release and security update
cxf: OAuth 2 authorization service vulnerable to DDos attacks CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter Tomcat: Information disclosure tomcat: local privilege escalation vulnerability
CVSS v3.1: 7
GHSA-397c-v74j-xjr8: Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Media Library Mime Type allows Stored XSS. This issue affects Rocket Media Library Mime Type: from n/a through 2.1.0.
CVSS v3.1: 7.1
GHSA-7xgw-66xc-q4x3: Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5032, and CVE-2013-5033.
CVE-2026-40785: WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability
Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
CVSS v3.1: 7.1
CVE-2021-38389: Advantech WebAccess
Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS v3.1: 9.8
CVE-2024-4540: Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
CVSS v3.1: 7.5
CVE-2022-31663: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
CVSS v3.1: 6.1
CVE-2021-34726: Cisco SD-WAN Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges.
CVSS v3.0: 6.7
GHSA-g2jr-rxc8-f5gf: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine.
CVSS v3.1: 7.8
GHSA-2298-wc49-vm4h: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
CVSS v3.1: 7.5
GHSA-f98m-jjcw-q3hm: Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
CVE-2024-37406: In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion.
CVSS v3.1: 7.5
GHSA-wg4v-4j73-j726: SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2023-5222: Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 5.8
CVE-2008-0609: Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS v2.0: 7.5
CVE-2024-9411: OFCMS add.json add cross site scripting
A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2018-0904: The Windows kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows information disclosure vulnerability due to how memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability".
CVSS v3.0: 4.7
CVSS v2.0: 1.9
CVE-2017-0920: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-6vm4-fpmx-wfvw: SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter.
GHSA-9v98-2cr3-2wq3: Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2021-40852: TCMAN GIM open redirect vulnerability
TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.
CVSS v3.1: 6.1
CVE-2018-3657: Multiple buffer overflows in Intel AMT in Intel CSME firmware versions before version 12.0.5 may allow a privileged user to potentially execute arbitrary code with Intel AMT execution privilege via local access.
CVSS v3.1: 6.7
CVSS v2.0: 7.2
CVE-2024-24447: A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a PDU Session Resource Setup Response with an empty Response Item list.
CVSS v3.1: 5.3
CVE-2024-50384: A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Web Component HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
CVSS v3.1: 6.5
GHSA-4ppw-rq8q-qq9j: A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument new_client leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263824.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-rp4v-qc77-phm4: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
CVSS v3.1: 4.3
GHSA-gqfp-2982-4j8v: KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin accounts with predefined credentials when a logged-in user visits the page.
CVSS v4.0: 5.1
CVSS v3.1: 5.3
CVE-2014-2898: wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of-bounds read when an error occurs, related to not checking the return code and MAC verification failure.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-2h2m-v2mg-656c: Craft Commerce has Stored XSS in Product Type Name
SummaryStored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings.The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. Reporting to Commerce GHSA since the input originates here.Users are recommended to update to the patched 5.5.2 release to mitigate the issue.Proof of ConceptRequired Permissions (Attacker)Admin access (to edit Commerce settings)Steps to ReproduceLog in as attacker with admin permissions.Go to **Commerce** -> **Settings** -> **Product Types** (`/admin/commerce/settings/producttypes`).Create a new Product Type.Set **Name** to:Save the Product Type.Go to **Users** -> Edit any user -> Click on **Permissions** tab (`/admin/users/{UserID}/permissions`).Alert fires instantly (when the Product Type checkbox renders).Resourceshttps://github.com/craftcms/commerce/commit/7e1dedf06038c8e70dce0187b7048d4ab8ffb75c
CVSS v4.0: 4.8
GHSA-3x66-jhf4-g79q: In the Linux kernel, the following vulnerability has been resolved:scsi: qla2xxx: Remove unused nvme_ls_waitq wait queueSystem crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up
gets called for uninitialized wait queue sp->nvme_ls_waitq.Remove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed
previously in the commits tagged Fixed: below.
CVSS v3.1: 5.5
CVE-2023-54143: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()
In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()

If we encounter any error in the vdec_msg_queue_init() then we need
to set "msg_queue->wdma_addr.size = 0;".  Normally, this is done
inside the vdec_msg_queue_deinit() function.  However, if the
first call to allocate &msg_queue->wdma_addr fails, then the
vdec_msg_queue_deinit() function is a no-op.  For that situation, just
set the size to zero explicitly and return.

There were two other error paths which did not clean up before returning.
Change those error paths to goto mem_alloc_err.
GHSA-6xp2-7gg6-fh9j: mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
GHSA-65hv-rxc9-c75q: Array index error in Adobe Reader and Acrobat, and the Explorer extension (aka AcroRd32Info), 8.1.2, 8.1.1, and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that triggers an out-of-bounds write, related to parsing of Type 1 fonts.
RHSA-2016:0056: Red Hat Security Advisory: java-1.7.0-oracle security update
TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions OpenJDK: URL deserialization inconsistencies (Networking, 8059054) OpenJDK: logging of RMI connection secrets (JMX, 8130710) OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
CVE-2014-7781: The Marijuana Handbook Lite - Weed (aka com.fallacystudios.marijuanahandbooklite) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2004-2728: Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.
CVSS v2.0: 3.5
GHSA-m924-ggx6-jfpw: The default configuration of EMC RecoverPoint Appliance (RPA) 4.1 before 4.1.0.1 does not enable a firewall, which allows remote attackers to obtain potentially sensitive information about open ports, or cause a denial of service, by sending packets to many ports.
CVE-2024-54044: Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 6.1
CVE-2025-43222: A use-after-free issue was addressed by removing the vulnerable code. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker may be able to cause unexpected app termination.
CVSS v3.1: 9.8
CVE-2017-6445: The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
CVSS v3.0: 8.1
CVSS v2.0: 7.6
CVE-2005-3145: httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service (resource consumption) by connecting to sblim-sfcb but not sending any data.
CVSS v2.0: 5
GHSA-3hmp-mj77-wcxf: In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
CVSS v3.0: 9.8
CVE-1999-1232: Untrusted search path vulnerability in day5datacopier in SGI IRIX 6.2 allows local users to execute arbitrary commands via a modified PATH environment variable that points to a malicious cp program.
CVSS v2.0: 7.2
CVE-2021-25350: Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log.
CVSS v3.1: 2
GHSA-c4ph-52m2-gvc6: Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.
CVSS v3.1: 8.1
PYSEC-2026-2: After an API Token exposure from an exploited Trivy dependency,
two new releases of `litellm` were uploaded to PyPI containing automatically activated malware,
harvesting sensitive credentials and files, and exfiltrating to a remote API.

The malicious code runs during importing any module from the package and scans
the file system and environment variables, collecting all kinds of
sensitive data, including but not limited to private SSH keys, credentials to Git and
Docker repositories, dotenv files, tokens to Kubernetes service accounts,
databases and LDAP configuration. Also exfiltrated are multiple shell history
files and cryptowallet keys. The malware actively attempts to obtain cloud access tokens
from metadata servers and retrieve secrets stored in AWS Secrets Manager.
All collected data are sent to the domain models.litellm[.]cloud

Furthermore, the code includes a persistence mechanism by configuring
a SystemD service unit masqueraded as "System Telemetry Service" on the host it
runs on, and in a Kubernetes environment also by creating a new pod.
The persistence script then contacts hxxps://checkmarx[.]zone/raw for
further instructions.

Anyone who has installed and run the project should assume
any credentials available to litellm environment may have been exposed,
and revoke/rotate them accordingly. The affected environment should be
isolated and carefully reviewed against any unexpected modifications 
and network traffic.
GHSA-gv73-3v96-pq6f: HP Service Manager 7.02, 7.11, 9.20, and 9.21 and Service Center 6.2.8 allow remote authenticated users to conduct unspecified script injection attacks via unknown vectors.
GHSA-xqww-pvrp-pccm: The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
GHSA-4w3v-xg6m-mghp: Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9, and 10.2.x before MR4; and Symantec Client Security 3.0.x and 3.1.x before MR9 allows remote attackers to execute arbitrary code via a long argument to the SetRemoteComputerName function.
CVE-2018-17784: Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
CVSS v3.1: 6.1
CVSS v2.0: 4.3