rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-30398 Nuance PowerScribe 360 Information Disclosure Vulnerability
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.1
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.2
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.3
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.4
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.5
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.6
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.7
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.8
vendor: Microsoft
product: Nuance PowerScribe 360 version 4.0.9
vendor: Microsoft
product: Nuance PowerScribe One version 2019.1
vendor: Microsoft
product: Nuance PowerScribe One version 2019.10
vendor: Microsoft
product: Nuance PowerScribe One version 2019.2
vendor: Microsoft
product: Nuance PowerScribe One version 2019.3
vendor: Microsoft
product: Nuance PowerScribe One version 2019.4
vendor: Microsoft
product: Nuance PowerScribe One version 2019.5
vendor: Microsoft
product: Nuance PowerScribe One version 2019.6
vendor: Microsoft
product: Nuance PowerScribe One version 2019.7
vendor: Microsoft
product: Nuance PowerScribe One version 2019.8
vendor: Microsoft
product: Nuance PowerScribe One version 2019.9
vendor: Microsoft
product: PowerScribe One version 2023.1 SP2 Patch 7
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:51.398Z
CVE-2025-30399 .NET and Visual Studio Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: Microsoft
product: .NET 8.0
vendor: Microsoft
product: .NET 9.0
vendor: Microsoft
product: Microsoft Visual Studio 2022 version 17.10
vendor: Microsoft
product: Microsoft Visual Studio 2022 version 17.12
vendor: Microsoft
product: Microsoft Visual Studio 2022 version 17.14
vendor: Microsoft
product: Microsoft Visual Studio 2022 version 17.8
vendor: Microsoft
product: PowerShell 7.4
vendor: Microsoft
product: PowerShell 7.5
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-06-13T01:08:00.208Z
CVE-2025-30400 Microsoft DWM Core Library Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2025-05-13T16:58:49.601Z
CVE-2025-30401 
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
Problem types: description: CWE-430
Affected products: vendor: Facebook
product: WhatsApp Desktop for Windows
default_status: unaffected
Published: 2025-04-05T11:47:54.836Z
CVE-2025-30402 
A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f
Problem types: description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: Meta Platforms, Inc
product: ExecuTorch
default_status: unaffected
Published: 2025-07-11T17:39:26.646Z
CVE-2025-30403 
A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.
Problem types: description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: Facebook
product: mvfst
default_status: unaffected
Published: 2025-07-11T18:26:51.212Z
CVE-2025-30404 
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
Problem types: description: Integer Overflow or Wraparound (CWE-190)
Affected products: vendor: Meta Platforms, Inc
product: ExecuTorch
default_status: unaffected
Published: 2025-08-07T22:46:57.161Z
CVE-2025-30405 
An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.
Problem types: description: Integer Overflow or Wraparound (CWE-190)
Affected products: vendor: Meta Platforms, Inc
product: ExecuTorch
default_status: unaffected
Published: 2025-08-07T22:55:40.262Z
CVE-2025-30406 
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Gladinet
product: CentreStack
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-04-03T00:00:00.000Z
CVE-2025-30407 
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Published: 2025-03-26T21:32:30.085Z
CVE-2025-30408 
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 16
default_status: unaffected
Credits: lang: en
value: @s3nds3c (https://hackerone.com/s3nds3c)
Published: 2025-04-24T13:04:26.690Z
CVE-2025-30409 
Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2025-04-24T13:04:41.220Z
CVE-2025-30410 
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 16
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 15
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2026-02-20T00:31:05.697Z
CVE-2025-30411 
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Problem types: cwe_id: CWE-1390
description: CWE-1390
Affected products: vendor: Acronis
product: Acronis Cyber Protect 16
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 15
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2026-02-20T00:30:14.748Z
CVE-2025-30412 
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Problem types: cwe_id: CWE-1390
description: CWE-1390
Affected products: vendor: Acronis
product: Acronis Cyber Protect 16
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 15
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2026-02-20T00:30:33.503Z
CVE-2025-30413 
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2026-03-05T23:56:29.887Z
CVE-2025-30415 
Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Problem types: cwe_id: CWE-1286
description: CWE-1286
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2025-06-04T12:02:21.200Z
CVE-2025-30416 
Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: Acronis
product: Acronis Cyber Protect 16
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 15
default_status: unaffected
Credits: lang: en
value: Airbus SecLab (mailto:vuln@airbus.com)
lang: en
value: Quentin Liddell (mailto:vuln@airbus.com)
lang: en
value: Mattéo Ricordeau (mailto:vuln@airbus.com)
lang: en
value: Benoît Camredon (mailto:vuln@airbus.com)
Published: 2026-02-20T00:31:27.426Z
CVE-2025-30417 Out of Bounds Write in Library!DecodeBase64() in NI Circuit Design Suite
There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: NI
product: Circuit Design Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl working with CISA
Published: 2025-05-15T16:18:53.901Z
CVE-2025-30418 Out of Bounds Write in CheckPins() in NI Circuit Design Suite
There is a memory corruption vulnerability due to an out of bounds write in CheckPins() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: NI
product: Circuit Design Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl working with CISA
Published: 2025-05-15T16:25:18.536Z
CVE-2025-30419 Out of Bounds Read in GetSymbolBorderRectSize() in NI Circuit Design Suite
There is a memory corruption vulnerability due to an out of bounds read in GetSymbolBorderRectSize() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: NI
product: Circuit Design Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl working with CISA
Published: 2025-05-15T16:27:44.419Z
CVE-2025-30420 Out of Bounds Read in Bitmap::InternalDraw() in NI Circuit Design Suite
There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: NI
product: Circuit Design Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl working with CISA
Published: 2025-05-15T16:29:39.374Z
CVE-2025-30421 Stack-based Buffer Overflow in DrObjectStorage::XML_Serialize() in NI Circuit Design Suite
There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: NI
product: Circuit Design Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl working with CISA
Published: 2025-05-15T16:32:33.387Z
CVE-2025-30422 
A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination.
Problem types: description: An attacker on the local network may cause an unexpected app termination
Affected products: vendor: Apple
product: AirPlay audio SDK
vendor: Apple
product: AirPlay video SDK
Published: 2025-04-30T20:48:15.738Z
CVE-2025-30424 
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Deleting a conversation in Messages may expose user contact information in system logging.
Problem types: description: Deleting a conversation in Messages may expose user contact information in system logging
Affected products: vendor: Apple
product: macOS
Published: 2025-03-31T22:22:26.067Z
CVE-2025-30425 
This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. A malicious website may be able to track users in Safari private browsing mode.
Problem types: description: A malicious website may be able to track users in Safari private browsing mode
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:22:50.104Z
CVE-2025-30426 
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:23:55.589Z
CVE-2025-30427 
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Problem types: description: Processing maliciously crafted web content may lead to an unexpected Safari crash
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:24:24.350Z
CVE-2025-30428 
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Photos in the Hidden Photos Album may be viewed without authentication.
Problem types: description: Photos in the Hidden Photos Album may be viewed without authentication
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
Published: 2025-03-31T22:22:34.013Z
CVE-2025-30429 
A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:22:41.739Z
CVE-2025-30430 
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication.
Problem types: description: Password autofill may fill in passwords after failing authentication
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:23:50.933Z
CVE-2025-30432 
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures.
Problem types: description: A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:22:28.969Z
CVE-2025-30433 
This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.
Problem types: description: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:22:47.415Z
CVE-2025-30434 
The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.4 and iPadOS 18.4. Processing a maliciously crafted file may lead to a cross site scripting attack.
Problem types: description: Processing a maliciously crafted file may lead to a cross site scripting attack
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2025-03-31T22:23:06.874Z