ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-jfmm-mjcp-8wq2: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
Summary`TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial.DetailsThe vulnerability is in `pkg/models/task_attachment.go` in the `ReadOne` method:The permission check in `pkg/models/task_attachment_permissions.go` validates access to the URL task, not the attachment's actual task:The `TaskAttachment` struct binds URL parameters via struct tags (`param:"task"` and `param:"attachment"`):**Attack flow for read (GET):**
The custom handler at `pkg/routes/api/v1/task_attachment.go:156` calls `CanRead` (checks URL task) then `ReadOne` (loads attachment by ID only).**Attack flow for delete (DELETE):**
The generic CRUD handler calls `CanDelete` (checks write on URL task) then `Delete` which calls `ReadOne` (loads any attachment by ID), then deletes it.This is the same vulnerability pattern that was already fixed for task comments, where `getTaskCommentSimple` was patched to add `AND task_id = ?` validation:PoC**Prerequisites:** Two users (attacker and victim). Victim has a project with a task that has a file attachment. Attacker has read access to any task (e.g., their own project).**Step 1:** Attacker creates their own project and task.**Step 2:** Victim uploads a confidential attachment to their task (in a different project the attacker has no access to).**Step 3:** Attacker downloads the victim's attachment by referencing their own task ID but the victim's attachment ID.**Step 4:** Attacker can also delete the victim's attachment.Since attachment IDs are sequential autoincrement integers, the attacker can enumerate all attachments in the system (1, 2, 3, ...).Impact**Confidentiality:** Any authenticated user can download any file attachment in the entire system, regardless of project permissions. This includes confidential documents, images, and any files uploaded as task attachments.**Integrity:** Any authenticated user with write access to any task can delete any attachment in the system, causing data loss for other users.**Enumeration:** Sequential integer IDs make it trivial to iterate through all attachments without any prior knowledge of target attachment IDs.**Scope:** Affects all Vikunja instances with task attachments enabled (the default).Recommended FixAdd `task_id` validation to `ReadOne`, mirroring the fix already applied to task comments:
CVSS v3.1: 8.1
GHSA-25xx-qj5q-8gm9: The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
CVSS v3.0: 7.5
CVE-2018-10328: Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
CVSS v3.0: 7.4
CVSS v2.0: 3.3
CVE-2013-7106: Multiple stack-based buffer overflows in Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long string to the (1) display_nav_table, (2) page_limit_selector, (3) print_export_link, or (4) page_num_selector function in cgi/cgiutils.c; (5) status_page_num_selector function in cgi/status.c; or (6) display_command_expansion function in cgi/config.c.  NOTE: this can be exploited without authentication by leveraging CVE-2013-7107.
CVSS v2.0: 6.5
CVE-2008-5052: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
CVSS v2.0: 10
GHSA-h5cv-7559-4wrj: Wiki Server in Apple Mac OS X 10.5 before 10.5.3 allows remote attackers to obtain sensitive information (user names) by reading the error message produced upon access to a nonexistent blog.
GHSA-w9qj-7hcw-22m3: A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /file/accept.php. The manipulation of the argument reqid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2025-25016: Kibana Unrestricted Upload of File
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
CVSS v3.1: 4.3
CVE-2021-3825: Missing Authorization Checks in LiderAhenk
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
CVSS v3.1: 9.6
CVE-2023-53461: io_uring: wait interruptibly for request completions on exit
In the Linux kernel, the following vulnerability has been resolved:

io_uring: wait interruptibly for request completions on exit

WHen the ring exits, cleanup is done and the final cancelation and
waiting on completions is done by io_ring_exit_work. That function is
invoked by kworker, which doesn't take any signals. Because of that, it
doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE
or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task
detection checker!

Normally we expect cancelations and completions to happen rather
quickly. Some test cases, however, will exit the ring and park the
owning task stopped (eg via SIGSTOP). If the owning task needs to run
task_work to complete requests, then io_ring_exit_work won't make any
progress until the task is runnable again. Hence io_ring_exit_work can
trigger the hung task detection, which is particularly problematic if
panic-on-hung-task is enabled.

As the ring exit doesn't take signals to begin with, have it wait
interruptibly rather than uninterruptibly. io_uring has a separate
stuck-exit warning that triggers independently anyway, so we're not
really missing anything by making this switch.
CVSS v3.1: 5.5
CVE-2025-25741: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module.
CVSS v3.1: 5.4
GHSA-qw53-xqjc-jq5q: In the Linux kernel, the following vulnerability has been resolved:memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timingsof_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
This function doesn't call of_node_put() in some error paths.
To unify the structure, Add put_node label and goto it on errors.
CVSS v3.1: 5.5
GHSA-78q7-8wjv-6g7x: An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of established bounds potentially resulting in loss of confidentiality or availability.
CVSS v4.0: 1.8
CVE-2016-6700: An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30916186.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2025-2004: Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion
The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2025-32509 is a duplicate of this.
CVSS v3.1: 9.1
CVE-2019-19795: samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
PYSEC-2014-77: Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
CVE-2015-3355: Multiple cross-site request forgery (CSRF) vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of certain users for requests that (1) delete a batch job record or (2) execute a task via unspecified vectors.
CVSS v2.0: 6.8
RHSA-2026:34076: Red Hat Security Advisory: ruby:2.5 security update
net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments
CVSS v3.1: 7.1
GHSA-prmx-7v35-7q82: a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function
A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.Upgrading to version 1.0.6 is able to resolve this issue. The patch is identified as e3e11c9e8482bd06b82fd9fced67be4856f0dffc. It is recommended to upgrade the affected component. The vendor acknowledged the issue but provides additional context for the CVSS rating: "a11y-mcp is a local stdio MCP server - it has no HTTP endpoint and is not network-accessible. The caller is always the local user or an LLM acting on their behalf with user approval."
CVSS v4.0: 1.9
CVSS v3.1: 5.3
GHSA-v2fg-9ph4-5293: When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94.
GHSA-2585-gp7f-g466: In the Linux kernel, the following vulnerability has been resolved:firmware_loader: Fix possible resource leak in fw_log_firmware_info()The alg instance should be released under the exception path, otherwise
there may be resource leak here.To mitigate this, free the alg instance with crypto_free_shash when kmalloc
fails.
CVSS v3.1: 5.5
GHSA-jcmm-g5mx-w4qq: In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82736068, a different vulnerability than CVE-2017-17475.
CVSS v3.0: 7.8
RHSA-2011:0152: Red Hat Security Advisory: java-1.4.2-ibm security update
krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005) OpenJDK HttpURLConnection incomplete TRACE permission check (6981426)
GHSA-53rm-9vx8-h5mq: CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
GHSA-wm6f-mjgq-8w6j: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function.
CVSS v3.1: 9.8
CVE-2016-3432: Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Web Server.
CVSS v3.0: 5.4
CVSS v2.0: 4.9
CVE-2020-0544: Insufficient control flow management in the kernel mode driver for some Intel(R) Graphics Drivers before version 15.36.39.5145 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-ghmh-jhmj-wcmf: nebula-mesh's stores enrollment tokens unhashed in SQLite
`internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `ConsumeToken` does `WHERE token = ?` against the raw string. Compare with `operator_api_keys.key_hash`, which is SHA-256 hex (constructed in `internal/api/middleware.go:51-53`).AffectedAll released versions up to v0.3.0.Threat modelRead access to `nebula-mgmt.db`: backup, snapshot, file-system access, future SQL-injection sink. The principle of defense-in-depth: API keys are hashed at rest; enrollment tokens — which grant the same lifecycle authority over a host's identity — are not.An attacker who reads the DB before a legitimate agent enrolls can consume the single-use token first, mint a cert against their own keypair, and take the agent's intended Nebula identity.Suggested fixSchema migration: rename `enrollment_tokens.token` → `token_hash` (or add the new column and drop the old after backfill of pending rows).Store SHA-256 of token on create:`ConsumeToken` accepts the raw token, hashes once, looks up by hash, atomically marks consumed.Side bonus: take this opportunity to switch the token format from `uuid.New().String()` (122 bits) to `hex.EncodeToString(crypto/rand 32 bytes)` (256 bits), matching the project's session-token and API-key conventions. UUIDs are recognisable in logs and crash dumps; opaque hex blends in.TOTP recovery codes appear to already be SHA-256 hashed at rest (`internal/web/totp.go:74-78`) — confirming that pattern is intentional elsewhere, just missed here.
CVSS v4.0: 5
CVE-2006-5312: PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0: 7.5
CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVSS v3.1: 6.6
CVSS v2.0: 8.5
GHSA-4xvh-6f9v-3x54: WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
GHSA-g38m-3x8r-8g8r: A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0. Affected is the function image_to_3d_async of the file src/index.ts of the component MCP Interface. The manipulation of the argument statusFile results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
RHSA-2024:1061: Red Hat Security Advisory: Red Hat Satellite 6 security and bug fix update
satellite: Blind SSRF via Referer header mosquitto: memory leak leads to unresponsive broker mosquitto: memory leak leads to unresponsive broker foreman: World readable file containing secrets mosquitto: memory leak leads to unresponsive broker
CVSS v3.1: 7.5
GHSA-f9m2-73w9-4c6c: IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2.6 could allow a local user with administrator privileges to obtain user passwords found in debugging messages. IBM X-Force ID: 142968.
CVSS v3.0: 6.7
GHSA-ff29-pr64-w428: Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page.
CVSS v3.0: 6.3
CVE-2006-6085: Kile before 1.9.3 does not assign a backup file the same permissions as the original file, which might allow local users to obtain sensitive information.
CVSS v2.0: 5
ICSA-22-202-01: ABB Drive Composer, Automation Builder, Mint Workbench
Vulnerabilities in Drive Composer allow a low-privileged user to create and write to a file anywhere on the file system as system with arbitrary content when the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a repair operation on the product.CVE-2022-31216 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vulnerabilities in Drive Composer allow a low-privileged user to create and write to a file anywhere on the file system as system with arbitrary content when the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a repair operation on the product.CVE-2022-31217 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vulnerabilities in Drive Composer allow a low privileged user to create and write to a file anywhere on the file system as system with arbitrary content when the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a repair operation on the product.CVE-2022-31218 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vulnerabilities in Drive Composer allow a low-privileged user to create and write to a file anywhere on the file system as system with arbitrary content when the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a repair operation on the product.CVE-2022-31219 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Vulnerabilities in Mint Workbench allow a low-privileged attacker to create and write to a file anywhere on the file system as system with arbitrary content when the file does not already exist. The Mint Workbench installer file allows a low-privileged user to run a repair operation on the product.CVE-2022-26057 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 6.7
CVE-2013-2275: The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
CVSS v2.0: 4
CVE-2024-2318: ZKTeco ZKBio Media Service Port 9999 download path traversal
A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql leads to path traversal: '../filedir'. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.3 Build 2025-05-26-1605 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-rr9p-xg7r-p8xg: Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
CVSS v3.1: 6.5
GHSA-c476-5cw2-72fp: The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1: 7.3
GHSA-wx2p-8rwf-q476: Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS v3.0: 7.5
RHSA-2026:17659: Red Hat Security Advisory: openexr security update
OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file
CVSS v3.1: 8.8
ICSA-21-068-03: Siemens SCALANCE and RUGGEDCOM Devices (Update A)
Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution.

Successful exploitation requires the passive listening feature of the device to be active.
CVSS v3.1: 8.8
GHSA-ph6w-f82w-28w6: Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning
When Claude Code was started in a new directory, it displayed a warning asking, "Do you trust the files in this folder?". This warning did not properly document that selecting "Yes, proceed" would allow Claude Code to execute files in the folder without additional confirmation. This may not have been clear to a user so we have updated the warning to clarify this functionality.Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version.Thank you to https://hackerone.com/avivdon for reporting this issue!
CVSS v4.0: 8.7
CVE-2025-58675: WordPress Interact: Embed A Quiz On Your Site Plugin <= 3.1 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through <= 3.1.
CVSS v3.1: 4.3
CVE-2006-5773: Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. (dot dot) in the action parameter.
CVSS v2.0: 5
CVE-2023-22855: Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code.
CVSS v3.1: 9.8
CVE-2014-7042: The My nTelos (aka com.telespree.ntelospostpay) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.  NOTE: nTelos Wireless has indicated that this vulnerability report is incorrect
CVSS v2.0: 5.4
RHSA-2025:1842: Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release
cross-spawn: regular expression denial of service
CVSS v3.1: 4.4