CVE-2024-30370

RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user. Was ZDI-CAN-23156.

• CWE-693

• https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixedRelease Notes
• https://www.zerodayinitiative.com/advisories/ZDI-24-357/Third Party Advisory, VDB Entry
• https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixedRelease Notes
• https://www.zerodayinitiative.com/advisories/ZDI-24-357/Third Party Advisory, VDB Entry

Published

Apr 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30365Foxit PDF Reader AcroForm Use-After-Free Remote Code Executi…7.8
• CVE-2024-30366Foxit PDF Reader AcroForm Use-After-Free Remote Code Executi…7.8
• CVE-2024-30367Foxit PDF Reader AcroForm Use-After-Free Remote Code Executi…7.8
• CVE-2024-30368A10 Thunder ADC CsrRequestView Command Injection Remote Code…8.8
• CVE-2024-30369A10 Thunder ADC Incorrect Permission Assignment Local Privil…7.8
• CVE-2024-3037An arbitrary file deletion vulnerability exists in PaperCut …7.8
• CVE-2024-30371Foxit PDF Reader AcroForm Use-After-Free Remote Code Executi…7.8
• CVE-2024-30372Allegra getLinkText Server-Side Template Injection Remote Co…6.3
• CVE-2024-30373Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote …7.8
• CVE-2024-30374Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write R…7.8
• CVE-2024-30375Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote…7.8
• CVE-2024-30376Famatech Advanced IP Scanner Uncontrolled Search Path Elemen…7.3