CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- joomlaJoomla! Open Redirect vulnerability7.5 High
- debian projectlThe save function in br/prefmanager.d in projectl 1.001 creates a projectL.prf file in the...4.6 Medium
- apple mac os x, mac os x server +1 moreLaunch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote...7.6 High
- opensuseopensuse-updater in openSUSE 10.2 allows local users to access arbitrary files via a symlink attack.4.9 Medium
- selinux setroubleshootsealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink...4.4 Medium
- nzbget, uudeview +1 moreuulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products,...4.4 Medium
- gforgeThe write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by...4.6 Medium
- bitrix24 bitrix site managerOpen redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to...6.1 Medium
- blenderMultiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related...6.9 Medium
- debian aptlinexaptlinex before 0.91 allows local users to overwrite arbitrary files via a symlink attack on the...7.2 High
- gnu emacs, sccs +1 morevcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary...4.6 Medium
- ibm db2 universal databasedb2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix...6.9 Medium
- cecilialib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink...3.3 Low
- sun solarisinetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary...4.7 Medium
- policyd-weightpolicyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files...3.3 Low
- mozilla firefox, seamonkey +1 moreGUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows...4.3 Medium
- axylThe prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink...6.9 Medium
- dovecotDovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create...4.4 Medium
- adobe acrobat readeracroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a...3.7 Low
- freshmeat xwinew_editeur.c in XWine 1.0.1 for Debian GNU/Linux allows local users to overwrite or print...7.2 High
- gentoo linuxexpn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows...7.2 High
- bea systems weblogic portalBEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can...7.5 High
- paul pelzl wyrdwyrd 1.4.3b allows local users to overwrite arbitrary files via a symlink attack on the wyrd-tmp....3.6 Low
- apache geronimoThe init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown...2.1 Low
- linux kernelLinux kernel 2.6, when using vservers, allows local users to access resources of other vservers...4.4 Medium
- website meta language meta languageWebsite META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink...3.6 Low
- website meta language meta languagewml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite...3.6 Low
- xoopsOpen redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to...5.0 Medium
- linux kernelcp, when running with an option to preserve symlinks on multiple OSes, allows local, user...6.9 Medium
- lumension security patchlink update, novell zenworks patch management update agent +1 morePatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for...4.6 Medium
- menalto galleryOpen redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect...6.4 Medium
- clam anti-virus clamavClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary...2.1 Low
- claws mail toolssylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary...3.6 Low
- audacityteam audacityAudacity 1.3.2 creates a temporary directory with a predictable name without checking for...5.0 Medium
- tug texlive 2007feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary...4.6 Medium
- fedoraproject coolkeyCoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary...3.3 Low
- gforgegforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on...3.3 Low
- bitchxThe e_hostname function in commands.c in BitchX 1.1a allows local users to overwrite arbitrary...4.6 Medium
- ibm aixcfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to...6.9 Medium
- vobcopyvobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new...4.9 Medium
- sitebarOpen redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect...6.4 Medium
- xensource inc xen(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary...6.0 Medium
- opensusehugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local...3.3 Low
- broadcom etrust integrated threat managementThe web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows...5.8 Medium
- gnu trampThe (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10...6.9 Medium
- debian guiltguilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log....3.3 Low
- skk openlab toolsThe main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete...4.4 Medium
- phpThe session extension in PHP before 5.2.4 might allow local users to bypass open_basedir...4.4 Medium
- qgitThe DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1...6.9 Medium
- kde konquerorKDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval...4.3 Medium
- Show moreLoading…