xamxte/cve-to-cwe huggingface dataset:
CVE-2019-11279: CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
CVE-2009-1669: The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function.  NOTE: some of these details are obtained from third party information.
CVE-2009-0048: OpenEvidence 1.0.6 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
CVE-2022-1489: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
CVE-2017-16735: A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. The SQL Injection vulnerability has been identified, which generates an error in the database log.
CVE-2013-4472: The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
CVE-2023-40569: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
CVE-2021-40766: Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2014-7127: The Football Espana magazine (aka com.triactivemedia.footballespana) application @7F0801AA for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2022-3196: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2012-1994: HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information
CVE-2025-69071: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP Local File Inclusion.This issue affects TanTum: from n/a through <= 1.1.13.
CVE-2023-51498: Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3.
CVE-2023-46012: Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD UPnP.
CVE-2016-6606: An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVE-2017-15728: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
CVE-2020-3517: A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attack vector is configuration dependent and could be remote or adjacent. For more information about the attack vector, see the Details section of this advisory. The vulnerability is due to insufficient error handling when the affected software parses Cisco Fabric Services messages. An attacker could exploit this vulnerability by sending malicious Cisco Fabric Services messages to an affected device. A successful exploit could allow the attacker to cause a reload of an affected device, which could result in a DoS condition.
CVE-2024-43623: Windows NT OS Kernel Elevation of Privilege Vulnerability
CVE-2017-0313: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges.
CVE-2024-11631: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /expedit.php. The manipulation of the argument expcat leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-27182: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual server is configured with the type set to Reject, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2025-22121: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()  There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172  CPU: 3 PID: 15172 Comm: syz-executor.0 Call Trace:  __dump_stack lib/dump_stack.c:82 [inline]  dump_stack+0xbe/0xfd lib/dump_stack.c:123  print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400  __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560  kasan_report+0x3a/0x50 mm/kasan/report.c:585  ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137  ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896  ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323  evict+0x39f/0x880 fs/inode.c:622  iput_final fs/inode.c:1746 [inline]  iput fs/inode.c:1772 [inline]  iput+0x525/0x6c0 fs/inode.c:1758  ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]  ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300  mount_bdev+0x355/0x410 fs/super.c:1446  legacy_get_tree+0xfe/0x220 fs/fs_context.c:611  vfs_get_tree+0x8d/0x2f0 fs/super.c:1576  do_new_mount fs/namespace.c:2983 [inline]  path_mount+0x119a/0x1ad0 fs/namespace.c:3316  do_mount+0xfc/0x110 fs/namespace.c:3329  __do_sys_mount fs/namespace.c:3540 [inline]  __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514  do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46  entry_SYSCALL_64_after_hwframe+0x67/0xd1  Memory state around the buggy address:  ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff                    ^  ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  Above issue happens as ext4_xattr_delete_inode() isn't check xattr is valid if xattr is in inode. To solve above issue call xattr_check_inode() check if xattr if valid in inode. In fact, we can directly verify in ext4_iget_extra_inode(), so that there is no divergent verification.
CVE-2023-23952: Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.
CVE-2025-60361: radare2 v5.9.8 and before contains a memory leak in the function bochs_open.
CVE-2014-7956: Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.
CVE-2006-5310: PHP remote file inclusion vulnerability in common/visiteurs/include/menus.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter.
CVE-2025-48603: In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62156: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.
CVE-2022-3929:  Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messages.   This issue affects       *  FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C;    *  UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C.     List of CPEs:    *  cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:*    *  cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:*    *  cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:*   *  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*
CVE-2022-45641: Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg.
CVE-2023-53368: In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix race issue between cpu buffer write and swap  Warning happened in rb_end_commit() at code:  if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)))    WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142  rb_commit+0x402/0x4a0   Call Trace:    ring_buffer_unlock_commit+0x42/0x250    trace_buffer_unlock_commit_regs+0x3b/0x250    trace_event_buffer_commit+0xe5/0x440    trace_event_buffer_reserve+0x11c/0x150    trace_event_raw_event_sched_switch+0x23c/0x2c0    __traceiter_sched_switch+0x59/0x80    __schedule+0x72b/0x1580    schedule+0x92/0x120    worker_thread+0xa0/0x6f0  It is because the race between writing event into cpu buffer and swapping cpu buffer through file per_cpu/cpu0/snapshot:    Write on CPU 0             Swap buffer by per_cpu/cpu0/snapshot on CPU 1   --------                   --------                              tracing_snapshot_write()                                [...]    ring_buffer_lock_reserve()     cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a';     [...]     rb_reserve_next_event()       [...]                                 ring_buffer_swap_cpu()                                  if (local_read(&cpu_buffer_a->committing))                                      goto out_dec;                                  if (local_read(&cpu_buffer_b->committing))                                      goto out_dec;                                  buffer_a->buffers[cpu] = cpu_buffer_b;                                  buffer_b->buffers[cpu] = cpu_buffer_a;                                  // 2. cpu_buffer has swapped here.        rb_start_commit(cpu_buffer);       if (unlikely(READ_ONCE(cpu_buffer->buffer)           != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer'         [...]           //    has not changed here.         return NULL;       }                                  cpu_buffer_b->buffer = buffer_a;                                  cpu_buffer_a->buffer = buffer_b;                                  [...]        // 4. Reserve event from 'cpu_buffer_a'.    ring_buffer_unlock_commit()     [...]     cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!!     rb_commit(cpu_buffer)       rb_end_commit()  // 6. WARN for the wrong 'committing' state !!!  Based on above analysis, we can easily reproduce by following testcase:   ``` bash   #!/bin/bash    dmesg -n 7   sysctl -w kernel.panic_on_warn=1   TR=/sys/kernel/tracing   echo 7 > ${TR}/buffer_size_kb   echo "sched:sched_switch" > ${TR}/set_event   while [ true ]; do           echo 1 > ${TR}/per_cpu/cpu0/snapshot   done &   while [ true ]; do           echo 1 > ${TR}/per_cpu/cpu0/snapshot   done &   while [ true ]; do           echo 1 > ${TR}/per_cpu/cpu0/snapshot   done &   ```  To fix it, IIUC, we can use smp_call_function_single() to do the swap on the target cpu where the buffer is located, so that above race would be avoided.
CVE-2022-41769: Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-34997: Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2013-5650: Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5, 7.2 before 7.2r10, 7.3 before 7.3r6, and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1, 4.2 before 4.2r5, 4.3 before 4.3r6 and 4.4 before 4.4r3, when a hardware SSL acceleration card is enabled, allows remote attackers to cause a denial of service (device hang) via a crafted packet.
CVE-2009-0341: The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element, possibly related to a stack consumption vulnerability.
CVE-2022-20736: A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This vulnerability is due to improper authorization checking for HTTP requests that are submitted to the affected web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected instance of AppDynamics Controller. A successful exploit could allow the attacker to access the login page for an administrative console. AppDynamics has released software updates that address this vulnerability.
CVE-2022-27062: AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.
CVE-2023-3700: Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVE-2023-32468:  Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged user could potentially exploit this vulnerability leading to exposure of this sensitive data.
CVE-2025-36379: IBM Security QRadar EDR 3.12 through 3.12.23 IBM Security ReaQta uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2009-3866: The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.
CVE-2009-4563: Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action.
CVE-2017-15823: In spectral_create_samp_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow.
CVE-2025-5266: Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.
CVE-2009-0864: S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie.
CVE-2024-42078: In the Linux kernel, the following vulnerability has been resolved:  nfsd: initialise nfsd_info.mutex early.  nfsd_info.mutex can be dereferenced by svc_pool_stats_start() immediately after the new netns is created.  Currently this can trigger an oops.  Move the initialisation earlier before it can possibly be dereferenced.
CVE-2023-52365: Out-of-bounds read vulnerability in the smart activity recognition module.Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2024-31801: Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request.
CVE-2016-6554: Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.
CVE-2011-1653: Multiple SQL injection vulnerabilities in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 allow remote attackers to execute arbitrary SQL commands via vectors involving the (1) UnAssignFunctionalRoles, (2) UnassignAdminRoles, (3) DeleteFilter, (4) NonAssignedUserList, (5) DeleteReportLayout, (6) DeleteReports, and (7) RegenerateReport stored procedures.
CVE-2023-6058: A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exceptions. This can lead to the interception and potential alteration of secure communications.
CVE-2018-7943: There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special operations. Due to insufficient authentication, an attacker may exploit the vulnerability to get some sensitive information and high-level users' privilege.
CVE-2019-11039: Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
CVE-2022-48423: In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.
CVE-2016-0029: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.
CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place
CVE-2021-28098: An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.
CVE-2016-8631: The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
CVE-2015-2525: Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass intended filesystem restrictions and delete arbitrary files via unspecified vectors, aka "Windows Task File Deletion Elevation of Privilege Vulnerability."
CVE-2020-5642: Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.