deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-37881
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()

The variable d->name, returned by devm_kasprintf(), could be NULL.
A pointer check is added to prevent potential NULL pointer dereference.
This is similar to the fix in commit 3027e7b15b02
("ice: Fix some null pointer dereference issues in ice_ptp.c").

This issue is found by our static analysis tool
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/052fb65335befeae8500e88d69ea022266baaf6d; https://git.kernel.org/stable/c/36d68151712e525450f0fbb3045e7110f0d9b610; https://git.kernel.org/stable/c/61006ca381b4d65d2b8ca695ea8da1ce18d6dee3
CVE: CVE-2025-37882
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

The TRB pointer of these events points at enqueue at the time of error
occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we
are handling the event, a new TD may be queued at this ring position.

I can trigger this race by rising interrupt moderation to increase IRQ
handling delay. Similar delay may occur naturally due to system load.

If this ever happens after a Missed Service Error, missed TDs will be
skipped and the new TD processed as if it matched the event. It could
be given back prematurely, risking data loss or buffer UAF by the xHC.

Don't complete TDs on xrun events and don't warn if queued TDs don't
match the event's TRB pointer, which can be NULL or a link/no-op TRB.
Don't warn if there are no queued TDs at all.

Now that it's safe, also handle xrun events if the skip flag is clear.
This ensures completion of any TD stuck in 'error mid TD' state right
before the xrun event, which could happen if a driver submits a finite
number of URBs to a buggy HC and then an error occurs on the last TD.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/16a7a8e6c47fea5c847beb696c8c21a7a44c1915; https://git.kernel.org/stable/c/39a080a2925c81b0f1da0add44722ef2b78e5454; https://git.kernel.org/stable/c/906dec15b9b321b546fd31a3c99ffc13724c7af4
CVE: CVE-2025-37883
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/sclp: Add check for get_zeroed_page()

Add check for the return value of get_zeroed_page() in
sclp_console_init() to prevent null pointer dereference.
Furthermore, to solve the memory leak caused by the loop
allocation, add a free helper to do the free job.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/28e5a867aa542e369e211c2baba[PII_REDACTED]a99; https://git.kernel.org/stable/c/397254706eba9d8f99fd237feede7ab3169a7f9a; https://git.kernel.org/stable/c/3b3aa72636a[PII_REDACTED]ec274a8747720c1ee3f
CVE: CVE-2025-37884
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix deadlock between rcu_tasks_trace and event_mutex.

Fix the following deadlock:
CPU A
_free_event()
  perf_kprobe_destroy()
    mutex_lock(&event_mutex)
      perf_trace_event_unreg()
        synchronize_rcu_tasks_trace()

There are several paths where _free_event() grabs event_mutex
and calls sync_rcu_tasks_trace. Above is one such case.

CPU B
bpf_prog_test_run_syscall()
  rcu_read_lock_trace()
    bpf_prog_run_pin_on_cpu()
      bpf_prog_load()
        bpf_tracing_func_proto()
          trace_set_clr_event()
            mutex_lock(&event_mutex)

Delegate trace_set_clr_event() to workqueue to avoid
such lock dependency.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/45286680b385f2592db[PII_REDACTED]388dee66d68; https://git.kernel.org/stable/c/4580f4e0ebdf8dc8d506ae926b88510395a0c1d1; https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
CVE: CVE-2025-37885
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Reset IRTE to host control if *new* route isn't postable

Restore an IRTE back to host control (remapped or posted MSI mode) if the
*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of
the GSI routing type.  Updating the IRTE if and only if the new GSI is an
MSI results in KVM leaving an IRTE posting to a vCPU.

The dangling IRTE can result in interrupts being incorrectly delivered to
the guest, and in the worst case scenario can result in use-after-free,
e.g. if the VM is torn down, but the underlying host IRQ isn't freed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/023816bd5fa46fab94d1e7917fe131b79ed1fb41; https://git.kernel.org/stable/c/116c7d35b8f72eac383b9fd371d7c1a8ffc2968b; https://git.kernel.org/stable/c/3066ec21d1a[PII_REDACTED]7f68638725f456308db
CVE: CVE-2025-37886
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

pds_core: make wait_context part of q_info

Make the wait_context a full part of the q_info struct rather
than a stack variable that goes away after pdsc_adminq_post()
is done so that the context is still available after the wait
loop has given up.

There was a case where a slow development firmware caused
the adminq request to time out, but then later the FW finally
finished the request and sent the interrupt.  The handler tried
to complete_all() the completion context that had been created
on the stack in pdsc_adminq_post() but no longer existed.
This caused bad pointer usage, kernel crashes, and much wailing
and gnashing of teeth.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381; https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380; https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892
CVE: CVE-2025-37887
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command
the driver might at the least print garbage and at the worst
crash when the user runs the "devlink dev info" devlink command.

This happens because the stack variable fw_list is not 0
initialized which results in fw_list.num_fw_slots being a
garbage value from the stack.  Then the driver tries to access
fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end
of the array.

Fix this by initializing the fw_list and by not failing
completely if the devcmd fails because other useful information
is printed via devlink dev info even if the devcmd fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/12a4651a80dbe4589a84e26785fbbe1ed4d043b7; https://git.kernel.org/stable/c/2567daad69cd1107fc0ec29b1615f110d7cf7385; https://git.kernel.org/stable/c/6702f5c6b22deaa95bf84f526148174a160a02cb
CVE: CVE-2025-37888
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()

Add NULL check for mlx5_get_flow_namespace() returns in
mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent
NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0b682680b12b08cd62b113ea92b2938195de1dfe; https://git.kernel.org/stable/c/91037037ee3d611ce17f39d75f79c7de394b122a; https://git.kernel.org/stable/c/ecd9d2647ddb4f42a121de648e48659ae1856c39
CVE: CVE-2025-37889
Published: 2025-05-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: ops: Consistently treat platform_max as control value

This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in
snd_soc_put_volsw() by +min"), and makes some additional related
updates.

There are two ways the platform_max could be interpreted; the maximum
register value, or the maximum value the control can be set to. The
patch moved from treating the value as a control value to a register
one. When the patch was applied it was technically correct as
snd_soc_limit_volume() also used the register interpretation. However,
even then most of the other usages treated platform_max as a
control value, and snd_soc_limit_volume() has since been updated to
also do so in commit fb9ad24485087 ("ASoC: ops: add correct range
check for limiting volume"). That patch however, missed updating
snd_soc_put_volsw() back to the control interpretation, and fixing
snd_soc_info_volsw_range(). The control interpretation makes more
sense as limiting is typically done from the machine driver, so it is
appropriate to use the customer facing representation rather than the
internal codec representation. Update all the code to consistently use
this interpretation of platform_max.

Finally, also add some comments to the soc_mixer_control struct to
hopefully avoid further patches switching between the two approaches.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0eba2a7e858907a746ba69cd002eb9eb4dbd7bf3; https://git.kernel.org/stable/c/296c8295ae34045da[PII_REDACTED]d49c1c060dd8a; https://git.kernel.org/stable/c/[PII_REDACTED]60d4b64fe204fc6be325ebc24c72ca
CVE: CVE-2025-3455
Published: 2025-05-09
Description: The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php#L403; https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e982ae88-cfd0-46b9-ad64-00e398d307d6?source=cve
CVE: CVE-2025-3605
Published: 2025-05-09
Description: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-user-settings.php#L59; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c11668c-6dc3-4539-b2be-bf6528bed73e?source=cve
CVE: CVE-2025-4467
Published: 2025-05-09
Description: A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-admin.php. The manipulation of the argument id/txtfullname/txtemail/cmddesignation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/SQL-2.md; https://vuldb.com/?ctiid.308086; https://vuldb.com/?id.308086
CVE: CVE-2025-4468
Published: 2025-05-09
Description: A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/upload.md; https://vuldb.com/?ctiid.308087; https://vuldb.com/?id.308087
CVE: CVE-2025-4469
Published: 2025-05-09
Description: A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /admin/add-admin.php. The manipulation of the argument txtusername/txtfullname/txtpassword/txtpassword2 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/xss-1.md; https://vuldb.com/?ctiid.308088; https://vuldb.com/?id.308088
CVE: CVE-2025-4470
Published: 2025-05-09
Description: A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-student.php. The manipulation of the argument Fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/xss-2.md; https://vuldb.com/?ctiid.308089; https://vuldb.com/?id.308089
CVE: CVE-2025-4471
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Affected by this issue is some unknown functionality of the component Search Item View. The manipulation of the argument str2 leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/BinX-Lab/Store_buffer_overflow; https://vuldb.com/?ctiid.308090
CVE: CVE-2025-4472
Published: 2025-05-09
Description: A vulnerability was found in code-projects Departmental Store Management System 1.0. It has been classified as critical. Affected is the function bill. The manipulation of the argument Item Code leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Department_Store_Management_System.md; https://vuldb.com/?ctiid.308094
CVE: CVE-2025-3949
Published: 2025-05-09
Description: The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/coming-soon/tags/6.18.15/app/lpage.php#L820; https://plugins.trac.wordpress.org/changeset/3288645/coming-soon/trunk/app/lpage.php; https://www.seedprod.com/docs/changelog/
CVE: CVE-2025-4403
Published: 2025-05-09
Description: The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L158; https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L360; https://plugins.trac.wordpress.org/changeset/3289478/
CVE: CVE-2025-46392
Published: 2025-05-09
Description: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.

There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. 


Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://lists.apache.org/thread/y1pl0mn3opz6kwkm873zshjdxq3dwq5s; https://www.cve.org/CVERecord?id=CVE-2024-29131; https://www.cve.org/CVERecord?id=CVE-2024-29133
CVE: CVE-2025-1087
Published: 2025-05-09
Description: Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application.
CWE: CWE-20, CWE-94
References: https://github.com/Kong/insomnia; https://tantosec.com/blog/2025/06/insomnia-api-client-template-injection/
CVE: CVE-2025-3528
Published: 2025-05-09
Description: A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.
CVSS Score: 8.2 (HIGH)
CWE: CWE-276
References: https://access.redhat.com/errata/RHBA-2025:9645; https://access.redhat.com/security/cve/CVE-2025-3528; https://bugzilla.redhat.com/show_bug.cgi?id=2359143
CVE: CVE-2025-3897
Published: 2025-05-09
Description: The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/eucookielaw/trunk/templates/EUCookieCache.php#L26; https://plugins.trac.wordpress.org/changeset/3288917/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d360de79-8490-4e70-b2d9-4f01a1ed3305?source=cve
CVE: CVE-2025-4206
Published: 2025-05-09
Description: The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/groundhogg/trunk/admin/tools/tools-page.php#L701; https://plugins.trac.wordpress.org/browser/groundhogg/trunk/admin/tools/tools-page.php#L912; https://plugins.trac.wordpress.org/changeset/3289364/
CVE: CVE-2025-4382
Published: 2025-05-09
Description: A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://access.redhat.com/security/cve/CVE-2025-4382; https://bugzilla.redhat.com/show_bug.cgi?id=2364416; https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=blobdiff;f=grub-core/kern/rescue_reader.c;h=a71ada8fb7da2eae6ee7135fe234fb1755ca78b0;hp=4259857ba9eea45446bc40ea13c3de4ab1b88ffd;hb=c448f511e74cb7c776b314fcb7943f98d3f22b6d;hpb=4abac0ad5a7914dd3cdfff08aaac06588bf98d80
CVE: CVE-2024-11861
Published: 2025-05-09
Description: EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0001.md; https://www.enersys.com/4996bf/globalassets/documents/corporate/cve/enersys_cve-2024-11861-final.pdf
CVE: CVE-2024-12442
Published: 2025-05-09
Description: EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0002.md; https://www.enersys.com/4996df/globalassets/documents/corporate/cve/enersys_cve-2024-12442-final.pdf
CVE: CVE-2025-45885
Published: 2025-05-09
Description: PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Attackers can inject malicious code from the parameter 'emailcont' and use it directly in SQL queries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/lintian31/vpm-system/blob/main/Vehicle%20parking%20Management%20System.md; https://github.com/lintian31/vpm-system/blob/main/Vehicle%20parking%20Management%20System.md
CVE: CVE-2025-45887
Published: 2025-05-09
Description: Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://gitee.com/wanglongcn/yifang/issues/IBZVAG
CVE: CVE-2024-13759
Published: 2025-05-09
Description: Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64  allows local attackers to gain system-level privileges via arbitrary file deletion
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.gendigital.com/us/en/contact-us/security-advisories/)
CVE: CVE-2024-13944
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-367
References: https://www.gendigital.com/us/en/contact-us/security-advisories/