ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rx9p-j44h-69cp: In the Linux kernel, the following vulnerability has been resolved:s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()crst_table_free() used to work with NULL pointers before the conversion
to ptdescs.  Since crst_table_free() can be called with a NULL pointer
(error handling in crst_table_upgrade() add an explicit check.Also add the same check to base_crst_free() for consistency reasons.In real life this should not happen, since order two GFP_KERNEL
allocations will not fail, unless FAIL_PAGE_ALLOC is enabled and used.
CVSS v3.1: 5.5
GHSA-3fx4-7f69-5mmg: Integer Overflow in go-jose
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
CVSS v3.0: 7.5
CVE-2023-45315: Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 5.5
CVE-2012-5485: registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
CVSS v2.0: 6.8
RHSA-2021:2039: Red Hat Security Advisory: Service Registry (container images) release and security update [1.1.1.GA]
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
CVSS v3.1: 7.5
GHSA-4h96-mv53-2c86: fast_id_map has a soundness issue and is unmaintained
`FastMap::get()` lacks sufficient checks to its parameter index and is used to unsafely get a `Vec` element.`fast_id_map` is unmaintained.
GHSA-p29w-9j4h-g34x: File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.
CVSS v3.1: 7.2
CVE-2021-25648: Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2002-0118: Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) 6.2.0 Beta Release 1.0 allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag.
CVSS v2.0: 7.5
GHSA-p9gq-m942-6h3h: Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2007-3525: Ripe Website Manager 0.8.9 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.8
CVE-2018-9540: In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-111450417
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2010-2500: Integer overflow in the gray_render_span function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
CVSS v2.0: 6.8
GHSA-q539-39f7-xr44: The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
CVSS v3.0: 8.8
CVE-2023-2247: In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
CVSS v3.1: 5.3
GHSA-q7xf-93c3-w2p7: The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 4.9
ICSA-25-226-25: Rockwell Automation Micro800
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF015. To recover, clear the fault.
CVSS v3.1: 9.8
CVE-2018-18457: The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf file, as demonstrated by pdftoppm.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2024-47896: GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
CVSS v3.1: 3.3
CVE-2008-1446: Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
CVSS v2.0: 9
CVE-2008-3831: The i915 driver in (1) drivers/char/drm/i915_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915_drv.c in OpenBSD does not restrict the DRM_I915_HWS_ADDR ioctl to the Direct Rendering Manager (DRM) master, which allows local users to cause a denial of service (memory corruption) via a crafted ioctl call, related to absence of the DRM_MASTER and DRM_ROOT_ONLY flags in the ioctl's configuration.
CVSS v2.0: 4.7
CVE-2024-1963: Uncontrolled Resource Consumption in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.
CVSS v3.1: 6.5
GHSA-gc42-wr8h-vr6f: rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
CVE-2000-1137: GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
CVSS v2.0: 4.6
CVE-2020-35965: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-92h4-jh72-6gpm: EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
CVSS v3.1: 8
CVE-2019-1053: Windows Shell Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox.
To exploit this vulnerability, an attacker would require unprivileged execution on the victim system.
The security update addresses the vulnerability by correctly validating folder shortcuts.
CVSS v3.1: 6.3
GHSA-mp4x-527r-p76p: Buffer overflow in the huh program in the orville-write package allows local users to gain root privileges.
GHSA-gfr2-q5q8-v55v: In the Linux kernel, the following vulnerability has been resolved:timers/migration: Fix livelock in tmigr_handle_remote_up()tmigr_handle_remote_cpu() skips timer_expire_remote() when cpu ==
smp_processor_id(), assuming the local softirq path already handled this
CPU's timers.This assumption is wrong because jiffies can advance after the handling of
the CPU's global timers in run_timer_base(BASE_GLOBAL) and before
tmigr_handle_remote() evaluates the expiry times.As a consequence a timer which expires after the CPU local timer wheel
advanced and becomes expired in the remote handling is ignored and the
callback is never invoked and removed from the timer wheel.What's worse is that fetch_next_timer_interrupt_remote() keeps reporting it
as expired, and the event is re-queued with expires == now on each
iteration.  The goto-again loop spins indefinitely.Fix this by calling timer_expire_remote() unconditionally. That's minimal
overhead for the common case as __run_timer_base() returns immediately if
there is nothing to expire in the local wheel.[ tglx: Amend change log and add a comment ]
CVSS v3.1: 7.5
GHSA-ch3c-v47x-4pgp: Cleartext Signed Message Signature Spoofing in openpgp
ImpactOpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools:These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest.
OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed.A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message:Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable.
Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature.
Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed.
Because of this, we consider the vulnerability impact to be very limited when the CleartextMessage is processed programmatically; this is reflected in the Severity CVSS assessment, specifically in the scope's score ("Unchanged").Patchesv5.10.1 (current stable version) will reject messages when calling `openpgp.readCleartextMessage()`v4.10.11 (legacy version) will reject messages when calling `openpgp.cleartext.readArmored()`WorkaroundsCheck the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.ReferencesSimilar CVE: https://sec-consult.com/vulnerability-lab/advisory/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/
CVSS v3.1: 4.3
CVE-2013-3457: Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772.
CVSS v2.0: 5
GHSA-phhw-p62x-84wp: Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
CVSS v3.1: 8.8
CVE-2022-22766: BD Pyxis Products - Hardcoded Credentials
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
CVSS v3.1: 7
RHSA-2020:2414: Red Hat Security Advisory: unbound security update
unbound: amplification of an incoming query into a large number of queries directed to a target unbound: infinite loop via malformed DNS answers received from upstream servers
CVSS v3.1: 7.5
CVE-2013-4274: Cross-site scripting (XSS) vulnerability in the password_policy_admin_view function in password_policy.admin.inc in the Password Policy module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the admin/config/people/password_policy/add page.
CVSS v2.0: 2.1
GHSA-3h8x-jv2f-mmvp: A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument adminname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-2vhf-f8q9-6wxf: An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
CVSS v3.0: 8.8
GHSA-w8m9-h9m6-p528: gnump3d 2.9final does not apply password protection to its plugins, which might allow remote attackers to bypass intended access restrictions.
RHSA-2026:13932: Red Hat Security Advisory: kernel security update
kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. kernel: ALSA: aloop: Fix racy access at PCM trigger kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling kernel: crypto: algif_aead - Revert to operating out-of-place kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() kernel: crypto: algif_aead - Fix minimum RX size check for decryption
CVSS v3.1: 7.1
CVE-2022-44617: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
CVSS v3.1: 7.5
CVE-2009-4796: Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.
CVSS v2.0: 7.5
GHSA-7c5c-3c2x-v5q8: The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.
CVSS v3.0: 9.8
RHSA-2025:18697: Red Hat Security Advisory: buildah security update from RHEL
An update for buildah is now available for Red Hat In-Vehicle-OS version 1.0.0.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-rfvx-872w-6rpr: The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
CVSS v3.1: 9.3
RHSA-2024:7506: Red Hat Security Advisory: cups-filters security update
cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes cups: libppd: remote command injection via attacker controlled data in PPD file cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source cups-browsed: cups-filters: cups-browsed vulnerable to DDoS amplification attack
CVSS v3.1: 7.5
CVE-2026-57950: ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.
CVSS v4.0: 8.6
CVSS v3.1: 8.1
CVE-2015-3089: Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3090, and CVE-2015-3093.
CVSS v2.0: 10
GHSA-q7xm-5mvx-f93m: Multiple unspecified vulnerabilities in PeopleTools component in Oracle PeopleSoft Enterprise 8.22 GA, 8.46 GA, 8.47 GA, 8.48 GA, 8.22.11, 8.46.15, 8.47.09, and 8.48.03 have unknown impact and remote authenticated attack vectors, aka Vuln# (1) PSE04, (2) PSE06, (3) PSE07, and (4) PSE08.
GHSA-4fm4-pcw7-99hg: The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron functionality.
CVE-2023-25595: Sensitive Information Disclosure in ClearPass OnGuard Ubuntu Agent
 A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to retrieve information that is of a sensitive nature to the ClearPass/OnGuard environment.
CVSS v3.1: 5.5
GHSA-9c9q-cmcw-fx7g: Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984.
CVSS v3.0: 5.4
GHSA-jr6m-ghrv-gqr2: The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice setsmtp_func function.
GHSA-hj69-c76v-86wr: Out-of-bounds Read in Pillow
`libImaging/FliDecode.c` in Pillow before 6.2.2 has an FLI buffer overflow.
CVSS v4.0: 8.3
CVSS v3.1: 7.1
GHSA-jvr3-h63f-grq7: High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
CVSS v4.0: 9.2
CVSS v3.1: 9.4
GHSA-9397-pxm9-3w6r: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.0.6.
CVSS v3.1: 5.9
CVE-2020-10118: cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-rrg8-hxw6-gqx4: A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer.
CVSS v3.1: 7.2
GHSA-3pwm-r3r4-xpvf: In the Linux kernel, the following vulnerability has been resolved:usb: config: fix iteration issue in 'usb_get_bos_descriptor()'The BOS descriptor defines a root descriptor and is the base descriptor for
accessing a family of related descriptors.Function 'usb_get_bos_descriptor()' encounters an iteration issue when
skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
the same descriptor being read repeatedly.To address this issue, a 'goto' statement is introduced to ensure that the
pointer and the amount read is updated correctly. This ensures that the
function iterates to the next descriptor instead of reading the same
descriptor repeatedly.
CVSS v3.1: 5.5
CVE-2025-26732: WordPress StoreBiz plugin <= 1.0.32 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware StoreBiz storebiz allows DOM-Based XSS.This issue affects StoreBiz: from n/a through <= 1.0.32.
CVSS v3.1: 6.5
CVE-2019-19953: In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2025-48105: WordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows Stored XSS.This issue affects Easy Flash Embed: from n/a through <= 1.0.
CVSS v3.1: 6.5
CVE-2011-2860: Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.
CVSS v2.0: 7.5
CVE-2020-13481: Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information.
CVSS v3.1: 6.1
CVE-2007-1401: Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allow local users to gain privileges via a long argument to the crack_opendict function.
CVSS v2.0: 6.9
CVE-2023-39709: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
CVSS v3.1: 6.1
CVE-2002-1028: Multiple buffer overflows in the CGI programs for Oddsock Song Requester WinAmp plugin 2.1 allow remote attackers to cause a denial of service (crash) via long arguments.
CVSS v2.0: 5
CVE-2023-29499: Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
CVSS v3.1: 5.5