ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-hrp8-4956-5gr5: Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
CVSS v3.1: 5.5
GHSA-9mhr-6wxf-g8f3: epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.
CVSS v3.0: 5.9
CVE-2008-6262: SQL injection vulnerability in lib/url/meta_url.php in SaturnCMS allows remote attackers to execute arbitrary SQL commands via the URL to the translate function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
RHSA-2026:17083: Red Hat Security Advisory: fence-agents security update
pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVSS v3.1: 7.5
CVSS v3.0: 7.5
GHSA-9fcc-rhq3-fh3c: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVSS v3.1: 7.5
RHSA-2020:1454: Red Hat Security Advisory: Satellite 6.7 release.
rubygem-net-ldap: Missing SSL Certificate Validation mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data
CVSS v3.1: 4.3
CVSS v3.0: 0
CVE-2022-26847: SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-8vq4-8hfp-29xh: Eugeny Tabby Sends Password Despite Host Key Verification Failure
An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.
CVSS v4.0: 7.7
CVE-2020-0257: In SpecializeCommon of com_android_internal_os_Zygote.cpp, there is a permissions bypass due to an incomplete cleanup. This could lead to local escalation of privilege in isolated processes with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-156741968
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2016-10484: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, if a RPMB listener is registered with a very small buffer size, the calculation of the maximum transfer size for read and write operations may underflow, resulting in buffer overflow.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-rxx9-7458-fmw6: An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter.
CVSS v3.0: 9.8
GHSA-p95x-pv3h-fh38: The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
CVSS v3.0: 7.2
CVE-2025-53425: WordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.
CVSS v3.1: 7.2
RHSA-2023:0095: Red Hat Security Advisory: libtiff security update
libtiff: division by zero issues in tiffcrop libtiff: division by zero issues in tiffcrop libtiff: division by zero issues in tiffcrop libtiff: Double free or corruption in rotateImage() function at tiffcrop.c libtiff: Assertion fail in rotateImage() function at tiffcrop.c libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c libtiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits() libtiff: tiffcrop.c has uint32_t underflow which leads to out of bounds read and write in extractContigSamples8bits() libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c
CVSS v3.1: 5.5
CVE-2015-5427: HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5428 and CVE-2015-5429.
CVSS v2.0: 7.5
GHSA-h22j-342g-797c: A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS v3.1: 4.4
CVE-2025-25102: WordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.
CVSS v3.1: 7.1
CVE-2023-24514: Stored Cross Site Scripting Vulnerability in Visual Console Module
Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS v3.1: 6.3
GHSA-wmrr-g68f-2fhj: In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-223578534
CVSS v3.1: 7.8
CVE-2020-16001: Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2021-44512: World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
CVSS v3.1: 7
CVSS v2.0: 4.4
CVE-2018-11358: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-36w9-vg85-fmgj: Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
GHSA-fcrr-6fjg-7jpj: A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be local or remote, and can lead to code execution and/or system crash.
GHSA-xxmq-4vph-956w: Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Impactcomrak is vulnerable to the upstream cmark issue, ["Issue revealed by fuzzer"](https://github.com/commonmark/cmark/issues/354). A large number of references in a markdown document can trigger an overly large response.Patches0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.Workaroundsn/aReferenceshttps://github.com/commonmark/cmark/issues/354
CVSS v3.1: 5.3
CVE-2025-9881: Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Ultimate Blogroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2026-11187: Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.3
CVE-2016-4202: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, and CVE-2016-4254.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-cfcw-xxj2-5vrw: A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2021-42297: Windows 10 Update Assistant Elevation of Privilege Vulnerability
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVSS v3.1: 5
GHSA-28cc-3w24-mfvx: The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS v3.1: 5.4
CVE-2020-7246: A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
CVE-2007-5135: Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow.  NOTE: this issue was introduced as a result of a fix for CVE-2006-3738.  As of 20071012, it is unknown whether code execution is possible.
CVSS v2.0: 6.8
GHSA-wcmp-q6x5-gv25: SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter in a contact modify action.
RHSA-2016:0197: Red Hat Security Advisory: firefox security update
graphite2: Out-of-bound read vulnerability triggered by crafted fonts graphite2: Null pointer dereference and out-of-bounds access vulnerabilities graphite2: Heap-based buffer overflow in context item handling functionality mozilla: out-of-bounds write with malicious font in graphite2 (MFSA 2016-38)
CVE-2018-9136: windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a different vulnerability than CVE-2018-8821.
CVSS v3.0: 5.5
CVSS v2.0: 7.1
GHSA-cmgj-xph9-cc49: BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution.
CVSS v3.1: 9.8
RHSA-2022:2074: Red Hat Security Advisory: samba security, bug fix, and enhancement update
samba: Symlink race error can allow metadata read and modify outside of the exported share samba: Information leak via symlinks of existance of files or directories outside of the exported share
CVSS v3.1: 6.5
CVE-2024-53016: Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while processing I2C settings in Camera driver.
CVSS v3.1: 6.6
GHSA-jj64-h3xq-fcxh: Improper input validation at one of the endpoints of Eaton xComfort ECI'sweb interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity
standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the
product. Upon retirement or end of support, there will be no new security updates, non-security
updates, or paid assisted support options, or online technical content updates.
CVSS v3.1: 8.8
CVE-2023-42922: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13.6.3, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to read sensitive location information.
CVSS v3.1: 5.5
GHSA-r228-mjrg-36ch: Unspecified vulnerability in the Oracle Landed Cost Management component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Shipment Workbench.
CVE-2006-1887: Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1 has unknown impact and attack vectors, aka Vuln# JDE01.
CVSS v2.0: 10
GHSA-cxc8-98jf-gx9h: Multiple buffer overflows in ha.c in the mipv6 daemon in UMIP 0.4 allow remote attackers to have an unspecified impact via a crafted (1) ND_OPT_PREFIX_INFORMATION or (2) ND_OPT_HOME_AGENT_INFO packet.
GHSA-v465-jg3m-pfpv: SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
GHSA-6cq2-cm9p-4m4h: Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through <= 5.9.5.
CVSS v3.1: 4.4
CVE-2017-3077: Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the PNG image parser. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2018-13745: The mintToken function of a smart contract implementation for STCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-3g85-xpc2-p2hq: The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
CVSS v3.1: 10
CVE-2007-5861: Unspecified vulnerability in Spotlight in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted .XLS file that triggers memory corruption in the Microsoft Office Spotlight Importer.
CVSS v2.0: 6.8
GHSA-44gv-fgcj-w546: Missing Authorization in DayByDay CRM
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
CVSS v3.1: 4.3
GHSA-jc97-h3h9-7xh6: Regular Expression Denial of Service in Deno.upgradeWebSocket API
ImpactVersions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.PatchesIt is recommended that users upgrade to Deno 1.31.0.
CVSS v3.1: 5.3
GHSA-9q7g-4v64-x75v: Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.
GHSA-64x7-8qh7-xq7m: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS.This issue affects Felan Framework: from n/a through 1.1.3.
CVSS v3.1: 7.1
GHSA-pwhj-4xxw-vr57: PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
CVE-2017-9537: Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.
CVSS v3.0: 4.8
CVSS v2.0: 3.5
CVE-2019-25044: The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-p3hr-944c-g4qr: Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect availability via unknown vectors.
GHSA-95mv-cmj7-gfh7: Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
CVE-2021-31681: Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.
CVSS v3.1: 7.8
CVE-2026-52192: An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component
CVE-2026-36807: Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS v3.1: 7.5
GHSA-5g4j-2gfr-rxr3: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.
CVSS v3.1: 7.5
GHSA-f52q-x25m-8fr8: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the (1) Oracle Application Object Library (APP02) and (2) Oracle Applications Manager (APP04).
GHSA-v955-2jxq-2w4r: In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.
CVE-2020-10628: ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2007-4675: Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR (QuickTime Virtual Reality) movie file containing a large size field in the atom header of a panorama sample atom.
CVSS v2.0: 9.3
CVE-2019-20812: An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
CVE-2020-9858: A dynamic library loading issue was addressed with improved path searching. This issue is fixed in Windows Migration Assistant 2.2.0.0 (v. 1A11). Running the installer in an untrusted directory may result in arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 4.4
GHSA-pjgc-q78w-v6ph: In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-mm2p-hcgv-77p3: An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.
CVSS v3.1: 6.5
RHSA-2021:0686: Red Hat Security Advisory: kernel security and bug fix update
kernel: bad kfree in auditfilter.c may lead to escalation of privilege kernel: performance counters race condition use-after-free kernel: ICMP rate limiting can be used for DNS poisoning attack kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free
CVSS v3.1: 7.8
GHSA-2pwc-7gr8-9w97: CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability.The specific flaw exists within the configuration of the wireless hotspot. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-24349.
CVSS v3.0: 7.6
GHSA-wrh6-2vcx-6fcm: Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an error message that includes the full pathname.
CVE-2008-5065: TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
CVSS v2.0: 7.5
RHSA-2020:2320: Red Hat Security Advisory: rh-maven35-jackson-databind security update
jackson-databind: Serialization gadgets in org.springframework:spring-aop jackson-databind: Serialization gadgets in commons-jelly:commons-jelly
CVSS v3.1: 8.1