ansulev/circl-vulnerability-scores huggingface dataset:
ICSA-22-349-09: Siemens Products affected by OpenSSL 3.0
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
CVSS v3.1: 7.5
CVE-2017-3212: The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v3.1: 5.9
CVSS v2.0: 4.3
CVE-2023-29215: Apache Linkis JDBC EngineCon  has a deserialization command execution
In Apache Linkis <=1.3.1, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a
deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.3.2.
CVSS v3.1: 9.8
GHSA-wgfc-hm58-hx63: Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.This issue affects AppBuilder: from 21.2 before 23.2.
CVSS v3.1: 4.9
GHSA-fhmg-8wxq-hr5w: The Educational Puzzles - Letters (aka com.EducationalPuzzlesLetters) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2022-50074: apparmor: Fix memleak in aa_simple_write_to_buffer()
In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix memleak in aa_simple_write_to_buffer()

When copy_from_user failed, the memory is freed by kvfree. however the
management struct and data blob are allocated independently, so only
kvfree(data) cause a memleak issue here. Use aa_put_loaddata(data) to
fix this issue.
CVSS v3.1: 5.5
CVE-2025-61220: The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information.
CVSS v3.1: 7.5
GHSA-7ff4-cv53-4cjq: phpMyAdmin SQL injection vulnerability
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
CVSS v3.1: 9.8
CVE-2022-22466: IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.  IBM X-Force ID:  225222.
CVSS v3.1: 6.8
CVE-2017-15580: osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-cr9m-89p3-99cj: DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2013-5486: Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036.  NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.
CVSS v2.0: 10
CVE-2012-2825: The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
CVSS v2.0: 5
CVE-2010-1987: Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption, out-of-bounds read, and application crash) via JavaScript code that appends long strings to the content of a P element, and performs certain other string concatenation and substring operations, related to the DoubleWideCharMappedString class in USP10.dll and the gfxWindowsFontGroup::GetUnderlineOffset function in xul.dll, a different vulnerability than CVE-2009-1571.
CVSS v2.0: 5
GHSA-hvm5-44j4-v5j4: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1245.
CVE-2014-1268: WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270.
CVSS v2.0: 6.8
GHSA-c279-989m-238f: Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted
SummaryA nil pointer dereference in `tunnelCloseHandler` causes the handler goroutine to panic whenever a reverse tunnel (rportfwd) close is attempted. Both the legitimate close path AND the unauthorized close path dereference `tunnel.SessionID` where `tunnel` is guaranteed nil. This means rportfwd tunnels can never be cleanly closed, and any authenticated implant can trigger repeated goroutine panics.DetailsFile: `server/handlers/sessions.go` lines 172 and 175The function enters an `else` block precisely because `core.Tunnels.Get(tunnelData.TunnelID)` returned `nil`. Both conditions inside that else block then dereference `tunnel.SessionID` instead of `rtunnel.SessionID`:Note: The identical bug was already fixed in `tunnelDataHandler` at lines 124/126 (correctly uses `rtunnel.SessionID`), but the fix was 
not applied to `tunnelCloseHandler`.PoCConfirmed on master commit `7ac4db3fa` with standalone reproducer.
Output:![1](https://github.com/user-attachments/assets/93b24286-3282-454f-80a4-b01abe4f1d63)
![2](https://github.com/user-attachments/assets/d4219aea-eb18-474c-b69a-a5e20e97161f)
![3](https://github.com/user-attachments/assets/5a76b0d7-ae5b-4d91-bfe9-730d3e5c322c)Impactrportfwd tunnels **cannot be closed** — functional regressionAny authenticated implant can trigger repeated handler goroutine panicsrtunnel map entries leak (never cleaned up on close failure)`recoverAndLogPanic()` prevents full server crash but silently drops the close operationFixReplace `tunnel.SessionID` with `rtunnel.SessionID` on both lines:
CVSS v4.0: 7.1
GHSA-8vqp-qfpf-cm68: A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.
CVSS v4.0: 7.1
CVE-2008-4258: Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validation Memory Corruption Vulnerability."
CVSS v2.0: 8.5
GHSA-g3mg-qjm8-7gj8: PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVE-2011-2663: Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.
CVSS v2.0: 10
CVE-2023-20962: In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-256590210
CVSS v3.1: 5.5
CVE-2020-5919: In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-fx9q-hq46-h25c: IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153748.
CVSS v3.0: 6.1
CVE-2017-18862: Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11, GS105Ev2 before 2017-05-11, GS105PE before 2017-05-11, GS108Ev3 before 2017-05-11, GS108PEv3 before 2017-05-11, GS116Ev2 before 2017-05-11, GSS108E before 2017-05-11, GSS116E before 2017-05-11, XS708Ev2 before 2017-05-11, and XS716E before 2017-05-11.
CVSS v3.1: 6.5
CVSS v2.0: 3.3
CVE-2021-36190: A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.
CVSS v3.1: 5.5
GHSA-ccfq-2454-f5xw: SillyTavern has a SSRF vulnerability in the CORS proxy middleware
ResolutionSillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a trusted environment, the filter is disabled by default, however it is strongly advised to be enabled and properly configured when an instance is being hosted over a network, as suggested by a console warning message and an officially published security checklist for administrators.Documentation:https://docs.sillytavern.app/administration/config-yaml/#private-address-whitelistinghttps://docs.sillytavern.app/administration/#security-checklistNote on future SSRF findingsSince the request filter applies to the entire application, no SSRF vulnerabilities against individual endpoints will be accepted, unless it has been proven that a properly configured and enabled filter can be bypassed in an undocumented way. Only advisories disclosed before the 1.18.0 release will be posted if their concern is SSRF.OverviewVulnerability Type: SSRFAffected Location: `src/middleware/corsProxy.js:31`Trigger Scenario: SSRF in optional CORS proxyRoot Cause`corsProxyMiddleware` forwards `req.params.url` directly into `fetch(url, ...)`. It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF.Source-to-Sink ChainSource (user-controlled input)Entry point: `GET /proxy/:url(*)`Data flowCode analysis shows concrete propagation into this sink:vulnerability title: `SSRF in optional CORS proxy`sink location reached by attacker-controlled input: `src/middleware/corsProxy.js:31`The same sink behavior is confirmed by controlled execution observations.Sink (dangerous operation)Sink location: `src/middleware/corsProxy.js:31`Vulnerable behavior: SSRF in optional CORS proxyExploitation PreconditionsThe attacker can control or influence a URL/endpoint parameter.The server can access internal or sensitive network targets.Outbound request validation or redirect controls are insufficient.RiskThis issue can be used to pivot network access and reach unintended internal resources.ImpactAn attacker may access internal network services or metadata endpoints and exfiltrate sensitive responses.RemediationEnforce strict destination allowlist for proxy targets.Block loopback, link-local, RFC1918, and metadata address ranges.Apply the same destination validation to redirects.
CVSS v4.0: 6.9
GHSA-vc5x-9m2r-pv7f: Directory traversal vulnerability in GoAhead Web Server 2.1 allows remote attackers to read arbitrary files via a URL with an encoded / (%5C) in a .. (dot dot) sequence.  NOTE: it is highly likely that this candidate will be REJECTED because it has been reported to be a duplicate of CVE-2001-0228.
GHSA-vfq9-7wg3-4mjx: Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-service by sending a crafted POST to '/bd_genie_create_account.cgi' with a sufficiently long parameter 'register_country'.
CVSS v3.1: 9.8
GHSA-r959-p85p-c67w: IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the environment. IBM X-Force ID: 140055.
CVSS v3.0: 8.8
CVE-2022-34289: A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted PCB files. This could allow an attacker to execute code in the context of the current process. (FG-VD-22-054)
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-m59c-782g-v69q: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVSS v3.1: 5.5
GHSA-f7qj-xcc8-v25j: Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2009-4076: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077.
CVSS v2.0: 6.8
GHSA-fg54-g768-97cx: Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, 11.0.0 through 11.4.0, and 12.0.0 allows remote attackers to affect integrity, related to BASE.
GHSA-h725-jppv-w85f: The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet.
CVSS v3.0: 7.5
GHSA-pc76-wwrm-9rgw: The Photo Gallery, Sliders, Proofing and   WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 5.9
CVE-2025-59198: Windows Search Service Denial of Service Vulnerability
Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
CVSS v3.1: 5
GHSA-5hcj-2v7m-qwqf: Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
GHSA-4cfc-4jgv-f8wc: Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting unsanitized input through the NTP_SERVER_LIST parameter. Attackers can send POST requests to the /korugan/time endpoint with script payloads in the NTP_SERVER_LIST parameter to execute arbitrary JavaScript in users' browsers.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
GHSA-cj5f-88xj-7wwh: SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-8299-8739-269v: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13101.
cisco-sa-20190206-wsa-bypass: Cisco Web Security Appliance Decryption Policy Bypass Vulnerability
A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied.

The vulnerability is due to the incorrect handling of SSL-encrypted traffic when Decrypt for End-User Notification is disabled in the configuration. An attacker could exploit this vulnerability by sending a SSL connection through the affected device. A successful exploit could allow the attacker to bypass a configured drop policy to block specific SSL connections.


Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-wsa-bypass ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-wsa-bypass"]
CVSS v3.0: 5.8
GHSA-rcgr-qvjp-p7c5: Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-8mx8-xx88-x7gm: A stored cross-site scripting (XSS) vulnerability in the /question/ask component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted question.
CVE-2025-54248: Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Scope is changed
CVSS v3.1: 7.7
GHSA-fgw8-2xqf-m7qv: Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2007-2996: Unspecified vulnerability in perl.rte 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2, and 5.8.2.10 through 5.8.2.50 on AIX 5.3, allows local users to gain privileges via unspecified vectors related to the installation and "waiting for a legitimate user to execute a binary that ships with Perl."
CVSS v2.0: 6.6
GHSA-xxrw-hw8c-v7g8: The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9
CVSS v3.1: 6.5
RHSA-2026:3685: Red Hat Security Advisory: kernel security update
kernel: ext4: fix use-after-free in ext4_orphan_cleanup kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare kernel: media: rc: fix races with imon_disconnect() kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation
CVSS v3.1: 7
CVE-2021-41573: Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link .
CVSS v3.1: 7.5
CVE-2023-45376: In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`
CVSS v3.1: 9.8
RHSA-2026:34774: Red Hat Security Advisory: Red Hat AI Base Images 3.0.2 (tpu)
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
CVSS v3.1: 8
CVE-2006-1689: Unspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.
CVSS v2.0: 7.2