Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-33025 State: PUBLISHED Published: 2025-05-13T09:38:49.056Z Last Updated: 2025-05-13T13:28:58.486Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-602 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (
, RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'traceroute' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with ro
issing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-301229.html
CVE ID: CVE-2025-33026 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-10-24T19:20:48.751Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: PeaZip Products: PeaZip Problem Types: CWE-830 Description: In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive tha
s file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://peazip.github.io/peazip-64bit.htm
le's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://peazip.github.io/peazip-64bit.html - https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md
CVE ID: CVE-2025-33027 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-10-24T19:21:55.948Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Bandisoft Products: Bandizip Problem Types: CWE-830 Description: In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a cr
r open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, Bandizip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bandisoft.c
for reading the file's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bandisoft.com/bandizip/ - https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33027%20%28Bandizip%29/CVE-2025-33027.md
CVE ID: CVE-2025-33028 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-10-24T19:26:49.555Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WinZip Products: WinZip Problem Types: CWE-830 Description: In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. Whe
ust visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, WinZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: a third party has reported that this is a false positive, and has observed that the original CVE-2025-33028.md file has been deleted on GitHub. Also, this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g
an increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.winzip.com/help/help_whatsnew.htm - https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33028%20%28WinZip%29/CVE-2025-33028.md - https://github.com/EnisAksu/Argonis/commit/5e1ff4e5f4fdb3f32aab465f7b429e0b91299d1d
CVE ID: CVE-2025-33029 State: PUBLISHED Published: 2025-11-11T16:51:11.949Z Last Updated: 2025-11-14T15:28:27.293Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi Software for Windows Problem Types: Denial of Service, CWE-787 Description: Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not presen
enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01398.html
CVE ID: CVE-2025-33031 State: PUBLISHED Published: 2025-06-06T15:52:14.292Z Last Updated: 2025-06-06T16:36:44.704Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-295 Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-16
CVE ID: CVE-2025-33032 State: PUBLISHED Published: 2025-08-29T17:16:51.497Z Last Updated: 2025-08-29T18:22:12.579Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/securit
uild 20250519 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-21
CVE ID: CVE-2025-33033 State: PUBLISHED Published: 2025-08-29T17:16:56.093Z Last Updated: 2025-08-29T18:22:05.936Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-33034 State: PUBLISHED Published: 2025-10-03T18:08:32.134Z Last Updated: 2025-10-03T18:36:27.297Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-33035 State: PUBLISHED Published: 2025-06-06T15:52:06.408Z Last Updated: 2025-06-06T16:36:50.201Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-16
CVE ID: CVE-2025-33036 State: PUBLISHED Published: 2025-08-29T17:17:00.802Z Last Updated: 2025-08-29T18:21:59.165Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-33037 State: PUBLISHED Published: 2025-08-29T17:17:05.931Z Last Updated: 2025-08-29T18:21:53.165Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-33038 State: PUBLISHED Published: 2025-08-29T17:17:11.149Z Last Updated: 2025-08-29T18:21:47.298Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-22
CVE ID: CVE-2025-33039 State: PUBLISHED Published: 2025-10-03T18:08:40.111Z Last Updated: 2025-10-03T18:38:24.565Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/secur
( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-33040 State: PUBLISHED Published: 2025-10-03T18:08:50.363Z Last Updated: 2025-10-03T18:39:08.950Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/secur
CVE ID: CVE-2025-33043 State: PUBLISHED Published: 2025-05-29T14:00:09.944Z Last Updated: 2025-11-03T19:53:58.639Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:N) Vendors: AMI Products: AptioV Problem Types: CWE-20 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025005.pdf
CVE ID: CVE-2025-33044 State: PUBLISHED Published: 2025-10-14T14:00:58.404Z Last Updated: 2025-10-14T18:52:35.278Z Vendors: AMI Products: AptioV Problem Types: CWE-119 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE ID: CVE-2025-33045 State: PUBLISHED Published: 2025-09-09T14:00:31.402Z Last Updated: 2025-09-09T14:15:08.538Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: AptioV Problem Types: CWE-123, CWE-200 Description: APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to information disclosure, arbitrary data writing, and impact Confidentiality, Integrity, and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go
onfidentiality, Integrity, and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025007.pdf
CVE ID: CVE-2025-33050 State: PUBLISHED Published: 2025-06-10T17:02:30.667Z Last Updated: 2025-07-11T16:36:37.442Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-693 Description: Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CI
re in Windows DHCP Server allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33050
CVE ID: CVE-2025-33051 State: PUBLISHED Published: 2025-08-12T17:09:45.207Z Last Updated: 2025-11-10T00:11:48.912Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
rized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33051
CVE ID: CVE-2025-33052 State: PUBLISHED Published: 2025-06-10T17:02:31.286Z Last Updated: 2025-07-11T16:36:37.932Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-908 Description: Use of uninitialized resource in Windo
Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-908 Description: Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33052
CVE ID: CVE-2025-33053 State: PUBLISHED Published: 2025-06-10T17:02:31.840Z Last Updated: 2025-10-21T22:55:12.879Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-73 Description: External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over
: External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053
CVE ID: CVE-2025-33054 State: PUBLISHED Published: 2025-07-08T16:56:59.842Z Last Updated: 2025-08-23T00:39:19.561Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-357 Description: Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-202
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33054
CVE ID: CVE-2025-33055 State: PUBLISHED Published: 2025-06-10T17:02:32.471Z Last Updated: 2025-07-11T16:36:39.130Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-125 Description: Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33055
CVE ID: CVE-2025-33056 State: PUBLISHED Published: 2025-06-10T17:02:33.076Z Last Updated: 2025-07-11T16:36:39.778Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind