ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-88j4-pcx8-q4q3: Password Change Vulnerability
Overview:A moderate security vulnerability has been identified in Uptime Kuma platform that poses a significant threat to the confidentiality and integrity of user accounts.  
When a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out.
This behaviour persists consistently, even after system restarts or browser restarts.
This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information.The same vulnerability was partially fixed in https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g but logging existing users out of their accounts was forgotten.Impact:The impact of this vulnerability is moderate, as it enables attackers or unauthorized individuals to maintain access to user accounts even after the account password has been changed. This can lead to unauthorized data access, manipulation, or compromise of user accounts, posing a threat to the integrity and confidentiality of Uptime Kuma.
A better impact-analysis is included in https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99gPoCChange the password for a user accountAccess the platform using the previously logged-in account without logging outNote that access (read-write) remains despite the password changeExpected behaviour:  
 After changing the password for a user account, all previously logged-in sessions should be invalidated, requiring users to log in again with the updated credentials.Actual behaviour:  
The system retains sessions and never logs out users unless explicitly done by clicking logout.Remediation:To mitigate the risks associated with this vulnerability, we made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change.It is recommended to Update Uptime Kuma to `>= 1.23.9`.Timeline:|Date|Event|
|--|--|
|2023-12-07 14:35 UTC| @manoonabbasi discovered and posts this information as a `bug`-report in issue #4188 [^1] into our **public issue tracker**, which is [**against our security policy**](https://github.com/louislam/uptime-kuma/security/policy) |
| 2023-12-07 16:50 UTC | The Uptime Kuma team deleted the post in our issue tracker |
| 2023-12-10 18:10 UTC | Uptime Kuma team released patch and this Advisory |[^1]: deleted to prevent the spread of this vulnerability without there being a fix available
CVSS v3.1: 6.7
CVE-2018-17379: SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2025-59510: Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.
CVSS v3.1: 5.5
GHSA-ff24-4prj-gpmj: Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
SummaryThe /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance.DetailsNo allowlist or denylist of destination hosts/CIDRsNo requirement for the caller to be authenticatedResponse handling produces four distinct outcomes observable by the caller:Valid JSON targets return a fully reflected response body if the returned fields fit the expected internal structNon-JSON HTTP 200 responses produce an error leaking the first byte of the response (`"Invalid JSON response: invalid character '<'..."`)Non-200 responses leak the HTTP status codeTCP-level failures distinguish between closed ports (`"connection refused"`) and filtered ones (`"i/o timeout"`)PoCSend an unauthenticated GET request to `/api/templates/fetch`, passing the target URL as the `url` query parameter.ImpactUnauthenticated port scanning of internal networksAccess to internal HTTP services not exposed to the public internet (service discovery endpoints, internal dashboards, Kubernetes API)
CVSS v3.1: 7.2
GHSA-fjq9-2cmr-75cm: An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices. Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is not required.
GHSA-5g68-4hrm-mwxw: zypp-refresh-patches in zypper in SUSE openSUSE 10.2, 10.3, and 11.0 does not ask the user before accepting repository keys, which allows remote repositories to cause a denial of service (package data corruption) via a spoofed key.
GHSA-3vr2-225w-q57h: A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/edit-category-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2014-2843: Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-54299: usb: typec: bus: verify partner exists in typec_altmode_attention
In the Linux kernel, the following vulnerability has been resolved:

usb: typec: bus: verify partner exists in typec_altmode_attention

Some usb hubs will negotiate DisplayPort Alt mode with the device
but will then negotiate a data role swap after entering the alt
mode. The data role swap causes the device to unregister all alt
modes, however the usb hub will still send Attention messages
even after failing to reregister the Alt Mode. type_altmode_attention
currently does not verify whether or not a device's altmode partner
exists, which results in a NULL pointer error when dereferencing
the typec_altmode and typec_altmode_ops belonging to the altmode
partner.

Verify the presence of a device's altmode partner before sending
the Attention message to the Alt Mode driver.
GHSA-jvg2-h67f-h9rw: A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
CVSS v3.1: 6.1
GHSA-8qgg-v38q-2m7f: Multiple cross-site scripting (XSS) vulnerabilities in act_newsletter.php in phpwcms 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) i and (2) text parameters.
CVE-2023-46348: SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods.
CVSS v3.1: 9.8
CVE-2017-2222: Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2013-3281: Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
CVSS v2.0: 4.3
GHSA-59vr-hqv4-rcgr: Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and viewing the driver's license column, an attacker could exploit this vulnerability to view the driver's license number and other personal information.
CVSS v3.0: 5.5
CVE-2017-15202: In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2013-2601: The NDVM in Citrix XenClient XT before 2.1.3 and 3.x before 3.1.4 allows remote attackers to execute arbitrary commands by using the UIVM to create a network connection.
CVSS v2.0: 7.5
CVE-2025-27716: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
CVSS v3.0: 6.5
GHSA-crcx-jrrv-jphf: Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
CVSS v3.0: 8
GHSA-jx34-r4cc-rrxr: Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin allows Stored XSS. This issue affects NetInsight Analytics Implementation Plugin: from n/a through 1.0.3.
CVSS v3.1: 7.1
CVE-2024-48465: The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter
CVSS v3.1: 9.8
CVE-2023-35939: GLPI vulnerable to unauthorized access to Dashboard data
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue.
CVSS v3.1: 8.1
GHSA-68cw-w9pp-fc96: In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.
CVSS v3.1: 9.8
GHSA-68qc-x6c7-f66c: An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file.
CVSS v3.0: 7.4
GHSA-mxm9-xprx-w4mm: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.
CVSS v3.1: 8.8
CVE-2023-26454: Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS v3.1: 7.6
GHSA-j9px-r24r-fm3p: A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS v3.1: 9.6
GHSA-2vp6-3rx5-75mf: Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
GHSA-vv8v-v4g3-hc9v: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages allows Stored XSS. This issue affects Map Categories to Pages: from n/a through 1.3.2.
CVSS v3.1: 5.9
CVE-2025-66330: App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 4.9
CVE-2024-47094: Logging of sitesecret to automations log
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.
CVSS v4.0: 5.7
GHSA-mxvq-xmr3-fr4w: AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the AVG Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22260.
CVSS v3.0: 7.8
CVE-2013-5704: The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states "this is not a security issue in httpd as such."
CVSS v2.0: 5
GHSA-wmcq-8969-56c5: A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/add-item.php. Such manipulation of the argument price leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-69h8-p3g9-h9gc: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker could inject malformed data into url input parameters to reboot the NVR. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS v4.0: 6.9
GHSA-p6cm-wgmg-cc45: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
CVSS v3.1: 7.1
GHSA-gcxf-4jrr-qpg3: A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVE-2025-49489: Resource leaks in cm
Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr 

components) allows Resource Leak Exposure. This vulnerability is associated with program files con_mgr/dialer_task.C.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS v3.1: 5.4
CVE-2016-0790: Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-8xq5-r7g5-m3f8: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions.This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload files to a location that should be restricted. To exploit this vulnerability, an attacker would need valid Read-Only Administrator&nbsp;credentials.
CVSS v3.1: 4.3
CVE-2007-3898: The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.
CVSS v2.0: 6.4
GHSA-pcfg-2qx6-cx4f: Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress allows Cross Site Request Forgery. This issue affects Varnish WordPress: from n/a through 1.7.
CVSS v3.1: 7.1
CVE-2020-1549: Windows CDP User Components Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory.
To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.
The security update addresses the vulnerability by correcting how the Windows CDP User Components handle memory.
CVSS v3.1: 7.8
GHSA-p4jw-hpfq-3fc6: MCServer in the Cisco Management Controller in Cisco Unified Computing System (UCS) allows local users to cause a denial of service (application crash) via invalid MCTools parameters, aka Bug ID CSCtg20734.
CVE-2021-2264: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS v3.1: 8.4
GHSA-w975-73p7-chcj: Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-2wjg-893f-qh7w: Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php.  NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.
GHSA-cpv7-4jr3-ww3h: In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.
CVSS v3.0: 5.3
CVE-2024-45008: Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved:

Input: MT - limit max slots

syzbot is reporting too large allocation at input_mt_init_slots(), for
num_slots is supplied from userspace using ioctl(UI_DEV_CREATE).

Since nobody knows possible max slots, this patch chose 1024.
CVSS v3.1: 5.5
GHSA-82h5-jxr3-6jxq: Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
CVSS v3.1: 5.4
GHSA-cjp9-8vv4-jm56: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <= 1.5.1.2 versions.
CVSS v3.1: 5.9
CVE-2026-34071: Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.
CVSS v3.1: 5.4
GHSA-44pj-p52j-6jrw: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier allows Stored XSS. This issue affects WebHotelier: from n/a through 1.9.2.
CVSS v3.1: 6.5
RHSA-2024:0862: Red Hat Security Advisory: gimp:2.8 security update
gimp: PSD buffer overflow RCE gimp: psp off-by-one RCE
CVSS v3.1: 7.8
PYSEC-2026-402: CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadequate input sanitization, can lead to the construction of a `package_path` that points to the root directory. Consequently, if an attacker can create a `config.yaml` file in a controllable path, this path can be appended to the `extensions` list and trigger the execution of `__init__.py` in the current directory, leading to remote code execution. The vulnerability affects versions from 5.9.0, and has been addressed in version 9.5.1.
CVSS v3.0: 9.8
CVE-2023-4568: PaperCut NG Unauthenticated XMLRPC
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
CVSS v3.1: 6.5
GHSA-6whm-f7w5-3m8c: Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP8 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote attackers to hijack the authentication of arbitrary users.
GHSA-vcmf-454v-8g3c: The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
CVE-2021-38995: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213073.
CVSS v3.0: 6.2
GHSA-6vg5-gh5c-gr5c: A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.
CVSS v3.1: 5.5
CVE-2021-24420: Request a Quote < 2.3.4 - Authenticated Stored XSS
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-h2x9-6rh9-j45r: Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.