ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-35572: On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.
CVSS v3.1: 7.5
GHSA-287g-7jjx-c8p9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4.
CVSS v3.1: 5.9
GHSA-mq86-p3gw-wcpj: In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
CVSS v3.1: 8.3
CVE-2017-7345: NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation (aka JMX RMI) service to the network, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-97r5-pg8x-p63p: Flask-Security-Too OAuth reauthentication freshness bypass via cross-   user OAuth identity acceptance
SummaryFlask-Security-Too 5.8.0's OAuth reauthentication flow can mark a
  session as fresh after verifying an OAuth account that belongs to a
  different user.If an attacker can operate an already-authenticated but stale victim
  session, they can complete OAuth verification using their own OAuth
  identity. The victim session is then treated as recently
  reauthenticated, allowing freshness-protected account actions to
  proceed. This was reproduced against the built-in `/change-username`
  route.DetailsThe issue is in the OAuth verification callback.`_oauth_response_common()` resolves the OAuth provider identity to a
  Flask-Security user:`flask_security/oauth_glue.py:101-108``oauth_verify_response()` then accepts any resolved user and updates
  the current session freshness timestamp:`flask_security/oauth_glue.py:182-214``flask_security/oauth_glue.py:201-204`The missing check is that the OAuth-resolved user must match the
  current authenticated session user. In the failing case:current session user: `victim@example.com`OAuth verified user: `attacker@example.com`session marked fresh: yesSo the attacker is not logging in as the victim, but they are
  satisfying the victim session's reauthentication requirement with a
  different account.PoCTested version:`Flask-Security-Too 5.8.0`tag `5.8.0`commit `08288dff6907e413d848a16aaf43fc2c2b2a3b72`Used a minimal Flask app with:
GHSA-x8jc-rp2j-5v75: Unspecified vulnerability in Oracle Pharmaceutical Applications 4.5.1 has unknown impact and remote authenticated attack vectors, aka Vuln# PHAR01.
CVE-2024-20151: In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01399339; Issue ID: MSV-1928.
CVSS v3.1: 6.7
CVE-2022-43561: Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.
CVSS v3.1: 6.4
CVE-2024-43589: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS v3.1: 8.8
RHSA-2023:3109: Red Hat Security Advisory: apr-util security update
apr-util: out-of-bounds writes in the apr_base64
CVSS v3.1: 6.5
CVE-2023-28622: WordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions.
CVSS v3.1: 5.9
GHSA-8vvx-qvq9-5948: Flowise allows arbitrary file write to RCE
SummaryAn attacker could write files with arbitrary content to the filesystem via the `/api/v1/document-store/loader/process` API.
An attacker can reach RCE(Remote Code Execution) via file writing.DetailsAll file writing functions in [packages/components/src/storageUtils.ts](https://github.com/FlowiseAI/Flowise/blob/main/packages/components/src/storageUtils.ts) are vulnerable.addBase64FilesToStorageaddArrayFilesToStorageaddSingleFileToStorageThe fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.Therefore, users can move to the parent folder via `../` and write files to any path.Once file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.In PoC (Proof of Concept), RCE was reached by overwriting package.json.PoCIn PoC, `package.json` is overwritten.
This is a scenario in which arbitrary code is executed when `pnpm start` is executed by changing the start command in the `scripts{}` statement to an arbitrary value.**- original start command****- modify start command**When a user runs the `pnpm start` command, a `pyozzi-poc` file is created in the `/tmp` path.1. package.json content base64 encoding2. Overwrite `package.json` via `/api/v1/document-store/loader/process`**Request Body**The part after `filename:` of the `txtFile` parameter is the value used as `fileName` in the function.
Add `../` to the filename value to move to the top path, then specify `package.json` in the project folder `/usr/src/` as the path.Afterwards, when the user starts the server (`pnpm start`), the added script will be executed. (`touch /tmp/pyozzi-poc`)**- starting server with `touch /tmp/pyozzi-poc` command**
<img width="737" alt="image" src="https://github.com/FlowiseAI/Flowise/assets/86613161/341be379-43ca-4acc-9126-dc398475fcf3">**- `/tmp/pyozzi-poc` file created**
<img width="751" alt="image" src="https://github.com/FlowiseAI/Flowise/assets/86613161/15707068-c000-4d59-972d-89d969c27087">Impact**Remote Code Execution (RCE)**
Although it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.
CVSS v3.1: 10
GHSA-cjj5-53h4-f55f: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a.
CVSS v3.1: 7.1
CVE-2025-45006: Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling potential physical memory access attacks.
CVSS v3.1: 9.1
GHSA-4ww5-vxfr-977m: The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the (1) username, (2) password, (3) usertheme, and (4) userlang cookies for unauthorized users, which has unknown impact and remote attack vectors.
CVE-2026-42377: WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects SureForms Pro: from n/a through 2.8.0.
CVSS v3.1: 7.3
CVE-2022-32978: There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-rvwh-q7gv-vwr9: The Interior Design (aka com.interior.design.mcreda) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2026-1397: PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes
The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-cp5j-wrwq-37jx: NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.
CVSS v3.1: 8.9
CVE-2025-69387: WordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in whatwouldjessedo Simple Retail Menus simple-retail-menus allows PHP Local File Inclusion.This issue affects Simple Retail Menus: from n/a through <= 4.2.1.
CVSS v3.1: 7.5
GHSA-9w2q-35qr-xff7: TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.
CVSS v3.1: 7.8
GHSA-fc6c-wh46-2q9r: In the Linux kernel, the following vulnerability has been resolved:nfs: Fix KMSAN warning in decode_getfattr_attrs()Fix the following KMSAN warning:CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)=====================================================
BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90
 decode_getfattr_attrs+0x2d6d/0x2f90
 decode_getfattr_generic+0x806/0xb00
 nfs4_xdr_dec_getattr+0x1de/0x240
 rpcauth_unwrap_resp_decode+0xab/0x100
 rpcauth_unwrap_resp+0x95/0xc0
 call_decode+0x4ff/0xb50
 __rpc_execute+0x57b/0x19d0
 rpc_execute+0x368/0x5e0
 rpc_run_task+0xcfe/0xee0
 nfs4_proc_getattr+0x5b5/0x990
 __nfs_revalidate_inode+0x477/0xd00
 nfs_access_get_cached+0x1021/0x1cc0
 nfs_do_access+0x9f/0xae0
 nfs_permission+0x1e4/0x8c0
 inode_permission+0x356/0x6c0
 link_path_walk+0x958/0x1330
 path_lookupat+0xce/0x6b0
 filename_lookup+0x23e/0x770
 vfs_statx+0xe7/0x970
 vfs_fstatat+0x1f2/0x2c0
 __se_sys_newfstatat+0x67/0x880
 __x64_sys_newfstatat+0xbd/0x120
 x64_sys_call+0x1826/0x3cf0
 do_syscall_64+0xd0/0x1b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7fThe KMSAN warning is triggered in decode_getfattr_attrs(), when calling
decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not
initialized.Fix the issue by initializing fattr->mdsthreshold to NULL in
nfs_fattr_init().
CVSS v3.1: 5.5
GHSA-9hgr-vpq9-fhqj: Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) env_dir parameter to (a) blank.php, (b) admin.php, or (c) builddb.php, and the (2) script_root parameter to blank.php.
GHSA-3vrr-x6c8-rfm2: Under certain circumstances a successful exploitation could result in access to the device.
CVSS v4.0: 8.7
CVE-2019-3986: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter.
CVSS v3.1: 8.8
CVSS v2.0: 8.3
GHSA-rx8q-gf7p-3fvp: CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.
CVE-2007-2938: Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to the (1) Send485CMD method, and possibly the (2) SetLoginID, (3) AddSite, (4) SetScreen, and (5) SetVideoServer methods.
CVSS v2.0: 10
CVE-2013-0611: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0614, and CVE-2013-0618.
CVSS v2.0: 10
CVE-2016-0411: Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1 and 11.2.0.4 allows local users to affect confidentiality, integrity, and availability via vectors related to Agent Next Gen.
CVSS v2.0: 4.6
CVE-2026-53058: drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()
In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()

In case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read()
in atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit
NULL pointer while trying to access the mutex. We need the connector to
be set before that. Unlike in legacy cases with flag
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised
in bridge_attach(), so add the mhdp->connector_ptr in device structure
to handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to
avoid possible NULL pointer dereference in recovery paths like
modeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.
CVE-2025-9105: Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting
A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhecimento/ of the component Informações Adicionais Page. Such manipulation of the argument Parecer/Conteúdos/Objetivos leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-56xv-9v42-q2cf: The Parental Control panel in Genexis devices with DRGOS before 1.14.1 allows remote authenticated users to execute arbitrary CLI commands via the (1) start_hour, (2) start_minute, (3) end_hour, (4) end_minute, or (5) hostname parameter.
CVSS v3.0: 8.8
GHSA-hh8r-hx5c-8r8r: Copilot Spoofing Vulnerability
CVSS v3.1: 6.5
CVE-2022-21325: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).
CVSS v3.1: 2.9
GHSA-m8hv-442x-vvx3: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.47, EX6150v2 before 1.0.1.76, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv3 before 1.0.2.70, and WN3100RPv2 before 1.0.0.66.
CVE-2017-20220: Serviio PRO 1.8 Unauthenticated Password Change via REST API
Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2018-9846: In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-hj9c-8jmm-8c52: Packing does not respect root-level ignore files in workspaces
Impact`npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include.PatchUpgrade to the latest, patched version of `npm` ([`v8.11.0`](https://github.com/npm/cli/releases/tag/v8.11.0) or greater), run: `npm i -g npm@latest`Node.js versions [`v16.15.1`](https://github.com/nodejs/node/releases/tag/v16.15.1), [`v17.19.1`](https://github.com/nodejs/node/releases/tag/v17.9.1) & [`v18.3.0`](https://github.com/nodejs/node/releases/tag/v18.3.0) include the patched `v8.11.0` version of `npm`Steps to take to see if you're impactedRun `npm publish --dry-run` or `npm pack` with an `npm` version `>=7.9.0` & `<8.11.0` inside the project's root directory using a workspace flag like: `--workspaces` or `--workspace=<name>` (ex. `npm pack --workspace=foo`)Check the output in your terminal which will list the package contents (note: `tar -tvf <package-on-disk>` also works)If you find that there are files included you did not expect, you should:
3.1. Create & publish a new release excluding those files (ref. ["Keeping files out of your Package"](https://docs.npmjs.com/cli/v8/using-npm/developers#keeping-files-out-of-your-package))
3.2. Deprecate the old package (ex. `npm deprecate <pkg>[@<version>] <message>`)
3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposedReferences[CVE-2022-29244](https://nvd.nist.gov/vuln/detail/CVE-2022-29244)[`npm-packlist`](https://github.com/npm/npm-packlist)[`libnpmpack`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpack)[`libnpmpublish`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish)
CVSS v3.1: 7.5
CVE-2022-45403: Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS v3.1: 6.5
GHSA-xxh2-5857-h7jc: Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.50.07.
CVSS v3.1: 5.3
CVE-2018-18865: The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure.
CVSS v3.0: 8.1
CVSS v2.0: 4.3
GHSA-37pq-893f-g7q5: Apereo CAS code injection vulnerability
A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component Groovy Code Handler. The manipulation leads to code injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.3
CVSS v3.1: 5
CVE-2023-4334: Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
CVSS v3.1: 7.5
CVE-2020-5351: Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only privileges.
CVSS v3.1: 7.5
GHSA-r58v-fqqp-24p8: With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
CVSS v3.0: 6.1
GHSA-wwwq-jmfm-4f5c: An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
CVSS v3.1: 8.8
CVE-2011-4620: Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message, as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.
CVSS v2.0: 9.3
CVE-2018-1352: A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
cisco-sa-CSPC-ILR-8qmW8y8X: Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability
A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting.

This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit this vulnerability by configuring non-log files as sources for syslog reporting through the web application. A successful exploit could allow the attacker to read non-log files on the CSPC.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1: 4.9
GHSA-hgj5-9jvf-p496: A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "announcement_gonggao" parameter.
GHSA-ph66-m9wc-38mf: A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI.
CVSS v3.0: 5.4
CVE-2024-38404: Buffer Over-read in Multi Mode Call Processor
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
CVSS v3.1: 7.5