Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31264 State: PUBLISHED Published: 2025-05-29T21:34:25.786Z Last Updated: 2025-05-30T22:02:48.615Z Vendors: Apple Products: macOS Problem Types: An attacker with physical access to a locked device may be able to view sensitive user information Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with physical access to a locked device may be able to view sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/122373 - https://support.apple.com/en-us/122374 - https://support.apple.co
References: - https://support.apple.com/en-us/122373 - https://support.apple.com/en-us/122374 - https://support.apple.com/en-us/122375
CVE ID: CVE-2025-31266 State: PUBLISHED Published: 2025-11-21T21:22:24.270Z Last Updated: 2025-11-23T11:32:09.916Z Vendors: Apple Products: macOS, Safari Problem Types: A website may be able to spoof the domain name in the title of a pop-up window Description: A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/122716 - https://support.apple.com/en-us/122719
CVE ID: CVE-2025-31267 State: PUBLISHED Published: 2025-07-10T22:23:29.784Z Last Updated: 2025-07-15T13:45:00.820Z Vendors: Apple Products: App Store Connect Problem Types: An attacker with physical access to an unlocked device may be able to view sensitive user information Description: An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/123356
CVE ID: CVE-2025-31268 State: PUBLISHED Published: 2025-09-15T22:34:47.930Z Last Updated: 2025-11-04T01:16:04.853Z Vendors: Apple Products: macOS Problem Types: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7. An app may be able to access protected user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/125112 - https://support.apple.com/en-us/125111
CVE ID: CVE-2025-31269 State: PUBLISHED Published: 2025-09-15T22:34:59.353Z Last Updated: 2025-11-04T01:16:32.031Z Vendors: Apple Products: macOS Problem Types: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8. An app may be able to access protected user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/125112
CVE ID: CVE-2025-31270 State: PUBLISHED Published: 2025-09-15T22:35:17.804Z Last Updated: 2025-11-03T18:09:19.137Z Vendors: Apple Products: macOS Problem Types: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/125110
CVE ID: CVE-2025-31271 State: PUBLISHED Published: 2025-09-15T22:35:26.153Z Last Updated: 2025-11-03T18:09:20.146Z Vendors: Apple Products: macOS Problem Types: Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen Description: This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26. Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/125110
CVE ID: CVE-2025-31273 State: PUBLISHED Published: 2025-07-29T23:29:17.520Z Last Updated: 2025-11-04T21:10:02.965Z Vendors: Apple Products: Safari, macOS, tvOS, visionOS, watchOS, iOS and iPadOS Problem Types: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124152 - https://support.apple.c
DP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124152 - https://support.apple.com/en-us/124149 - https://support.apple.com/en-us/124153 - https://support.apple.com/en-us/124154 - https://support.apple.com/en-us/124155 - https://support.apple.com/en-us/124147
CVE ID: CVE-2025-31275 State: PUBLISHED Published: 2025-07-29T23:29:07.499Z Last Updated: 2025-11-03T19:52:43.963Z Vendors: Apple Products: macOS Problem Types: A sandboxed process may be able to launch any installed app Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124149
CVE ID: CVE-2025-31276 State: PUBLISHED Published: 2025-07-29T23:35:57.153Z Last Updated: 2025-11-03T19:52:45.323Z Vendors: Apple Products: iPadOS, iOS and iPadOS Problem Types: Remote content may be loaded even when the 'Load Remote Images' setting is turned off Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124148 - https://support.apple.com/en-us/124147
CVE ID: CVE-2025-31277 State: PUBLISHED Published: 2025-07-29T23:29:31.341Z Last Updated: 2025-11-03T19:52:50.809Z Vendors: Apple Products: Safari, macOS, tvOS, visionOS, watchOS, iOS and iPadOS Problem Types: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124152 - https://support.apple.c
CVE ID: CVE-2025-31278 State: PUBLISHED Published: 2025-07-29T23:35:08.211Z Last Updated: 2025-11-04T21:10:04.731Z Vendors: Apple Products: Safari, iPadOS, macOS, tvOS, visionOS, watchOS, iOS and iPadOS Problem Types: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iPadOS 17.7.9, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124152 -
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124152 - https://support.apple.com/en-us/124148 - https://support.apple.com/en-us/124149 - https://support.apple.com/en-us/124153 - https://support.apple.com/en-us/124154 - https://support.apple.com/en-us/124155 - https://support.apple.com/en-us/124147
CVE ID: CVE-2025-31279 State: PUBLISHED Published: 2025-07-29T23:29:02.921Z Last Updated: 2025-11-03T19:53:01.868Z Vendors: Apple Products: iPadOS, macOS Problem Types: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, iPadOS 17.7.9, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to fingerprint the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124148 - https://support.apple.com/en-us/124149 - https://support.apple.com/en-us/124150 - https://support.apple.com/en-us/124151
CVE ID: CVE-2025-31280 State: PUBLISHED Published: 2025-07-29T23:35:11.230Z Last Updated: 2025-11-03T19:53:03.260Z Vendors: Apple Products: macOS Problem Types: Processing a maliciously crafted file may lead to heap corruption Description: A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted file may lead to heap corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124149
CVE ID: CVE-2025-31281 State: PUBLISHED Published: 2025-07-29T23:28:59.552Z Last Updated: 2025-11-03T19:53:08.752Z Vendors: Apple Products: macOS, tvOS, visionOS, iOS and iPadOS Problem Types: Processing a maliciously crafted file may lead to unexpected app termination Description: An input validation issue was addressed with improved memory handling. This issue is fixed in visionOS 2.6, tvOS 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6. Processing a maliciously crafted file may lead to unexpected app termination. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/124149 - https://support.apple.com/en-us/124153 - ht
VE Program Container: References: - https://support.apple.com/en-us/124149 - https://support.apple.com/en-us/124153 - https://support.apple.com/en-us/124154 - https://support.apple.com/en-us/124147
CVE ID: CVE-2025-31282 State: PUBLISHED Published: 2025-04-02T16:38:38.227Z Last Updated: 2025-05-02T15:33:59.766Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Vision One Problem Types: CWE-269 Description: A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
end service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019386
CVE ID: CVE-2025-31283 State: PUBLISHED Published: 2025-04-02T16:39:12.847Z Last Updated: 2025-04-07T13:42:31.952Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Vision One Problem Types: CWE-269 Description: A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
d service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019386
CVE ID: CVE-2025-31284 State: PUBLISHED Published: 2025-04-02T16:39:23.853Z Last Updated: 2025-04-07T13:42:42.541Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Vision One Problem Types: CWE-269 Description: A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References
rvice and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019386
CVE ID: CVE-2025-31285 State: PUBLISHED Published: 2025-04-02T16:39:33.203Z Last Updated: 2025-04-07T13:42:52.372Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Vision One Problem Types: CWE-269 Description: A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019386
CVE ID: CVE-2025-31286 State: PUBLISHED Published: 2025-04-02T16:39:41.799Z Last Updated: 2025-04-07T13:43:02.128Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Vision One Problem Types: CWE-269 Description: An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019386
CVE ID: CVE-2025-31324 State: PUBLISHED Published: 2025-04-24T16:50:27.706Z Last Updated: 2025-10-21T22:55:17.980Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver (Visual Composer development server) Problem Types: CWE-434 Description: SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
ity, and availability of the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3594142 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31325 State: PUBLISHED Published: 2025-06-10T00:10:30.542Z Last Updated: 2025-06-10T15:27:05.593Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver (ABAP Keyword Documentation) Problem Types: CWE-79 Description: Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the attacker limited access to restricted information. The vulnerability does not affect data integrity or availabi
ding the attacker limited access to restricted information. The vulnerability does not affect data integrity or availability and operates entirely within the context of the client's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3590887 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31326 State: PUBLISHED Published: 2025-07-08T00:34:21.578Z Last Updated: 2025-07-08T16:14:46.644Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Problem Types: CWE-80 Description: SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as redirecting users to attacker-controlled domains. This issue primarily affects the integ
f application behavior, such as redirecting users to attacker-controlled domains. This issue primarily affects the integrity of the system. However, the confidentiality and availability of the system remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3573199 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31327 State: PUBLISHED Published: 2025-04-22T18:25:45.777Z Last Updated: 2025-04-23T15:58:54.786Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Field Logistics Problem Types: CWE-472 Description: SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3359825 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31328 State: PUBLISHED Published: 2025-04-22T18:25:55.117Z Last Updated: 2025-04-23T15:58:47.132Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP S/4 HANA (Learning Solution) Problem Types: CWE-352 Description: SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability. Additional Analyst Notes: - CISA ADP Vulnric
iality and integrity of the application without affecting the availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3446649 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31329 State: PUBLISHED Published: 2025-05-13T00:16:51.190Z Last Updated: 2025-05-13T13:55:58.324Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP and ABAP Platform Problem Types: CWE-141 Description: SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as user credentials is exposed. These credentials may then be used to gain unauthorized access to local
information such as user credentials is exposed. These credentials may then be used to gain unauthorized access to local or adjacent systems. This results in high impact to Confidentiality, with no significant effect on Integrity or Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3577287 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31330 State: PUBLISHED Published: 2025-04-08T07:15:13.611Z Last Updated: 2025-04-10T03:55:35.593Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Landscape Transformation (Analysis Platform) Problem Types: CWE-94 Description: SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity
tively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3587115 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31331 State: PUBLISHED Published: 2025-04-08T07:15:23.750Z Last Updated: 2025-04-08T13:15:55.752Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Problem Types: CWE-863 Description: SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitive system code without proper authorization. This vulnerability compromises the confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.c
ility compromises the confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3577131 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31332 State: PUBLISHED Published: 2025-04-08T07:15:36.708Z Last Updated: 2025-04-08T14:50:26.172Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-277 Description: Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this vulnerability does not disclose any sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
ever, this vulnerability does not disclose any sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3565751 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31333 State: PUBLISHED Published: 2025-04-08T07:15:46.176Z Last Updated: 2025-04-08T14:50:18.739Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP S4CORE entity Problem Types: CWE-472 Description: SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3525971 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-31334 State: PUBLISHED Published: 2025-04-03T05:27:32.538Z Last Updated: 2025-04-03T13:52:45.659Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: RARLAB Products: WinRAR Problem Types: CWE-356 Description: Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.win-rar.com/start.html?&L=0 - https://jvn.jp/en/jp/JVN59547048/