CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- openfabrics enterprise distributionopenibd in OpenFabrics Enterprise Distribution (OFED) 1.5.2 allows local users to overwrite...6.3 Medium
- gnu glibcelf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x...6.9 Medium
- cisco anyconnect ssl vpnThe Cisco trial client on Linux for Cisco AnyConnect SSL VPN allows local users to overwrite...3.3 Low
- apereo phpcasPGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to...3.3 Low
- redhat spice-xpiThe SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to overwrite arbitrary files...3.3 Low
- gnu gvGNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a...3.3 Low
- canonical ubuntu linuxpam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10...6.9 Medium
- apple cupsThe cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to...2.6 Low
- apple mac os x, mac os x server +1 moreFolder Manager in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows local users to delete...3.3 Low
- vincent fourmond pmountThe make_lockdir_name function in policy.c in pmount 0.9.18 allow local users to overwrite...1.9 Low
- emeseneemesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary...3.3 Low
- wolfram research mathematicaMathematica 7, when running on Linux, allows local users to overwrite arbitrary files via a...1.9 Low
- mysqlMySQL before 5.1.46 allows local users to delete the data and index files of another user's...3.6 Low
- gnu nanoGNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in...1.9 Low
- sun solarisCertain patch-installation scripts in Oracle Solaris allow local users to append data to...3.3 Low
- chip salzenberg deliverChip Salzenberg Deliver allows local users to cause a denial of service, obtain sensitive...6.9 Medium
- pulseaudioThe pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users...6.9 Medium
- thibault godouet fcronfcrontab in fcron before 3.0.5 allows local users to read arbitrary files via a symlink attack on...1.9 Low
- fwbuilder firewall builderFirewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain...3.3 Low
- puppetPuppet arbitrary files overwrite via a symlink attack3.3 Low
- ncpfsncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or...4.4 Medium
- sambaclient/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4...4.4 Medium
- fedorahosted cronie, paul vixie vixie cron +1 moreThe edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron)...3.3 Low
- becauseinter bournalBournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on...3.3 Low
- fusefusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an...3.3 Low
- saini videocachevccleaner in VideoCache 1.9.2 allows local users with Squid proxy user privileges to overwrite...3.3 Low
- gnu coreutils, canonical ubuntu linux, fedoraproject fedora +2 moreThe distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain...4.4 Medium
- merkaartorMerkaartor 0.14 allows local users to append data to arbitrary files via a symlink attack on the ...3.3 Low
- gforgeGForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink...3.3 Low
- mysqlMySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE...4.4 Medium
- mysqlsql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha,...6.0 Medium
- novell suse linux, opensuse +1 moreiscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE)...4.4 Medium
- postfixThe postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the...6.9 Medium
- adobe air, flash player, flex +2 moreAdobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2,...4.3 Medium
- isc dhcp, redhat enterprise linux +1 moreThe configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise...6.9 Medium
- xfig, debian linux +1 moreXfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack...4.4 Medium
- emn coccinelleCoccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an...3.3 Low
- directadminJBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a...6.9 Medium
- wordpressOpen redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote...4.3 Medium
- viart shopViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an...4.3 Medium
- viart shopViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a...4.3 Medium
- james stone tunapieJames Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on...4.4 Medium
- fedoraproject fedora, redhat cluster project, cman +2 more +4 moreRed Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink...6.9 Medium
- sun xvm virtualboxSun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux...6.9 Medium
- eric raymond sngsng_regress in SNG 1.0.2 allows local users to overwrite arbitrary files via a symlink attack on...6.9 Medium
- alcovebook sgml2xrlatex in AlcoveBook sgml2x 1.0.0 allows local users to overwrite arbitrary files via a symlink...4.4 Medium
- ibm websphere application serverOpen redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application...5.8 Medium
- rockwellautomation controllogix 1756-enbt\/a ethernet\/ ip bridgeOpen redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756...6.8 Medium
- mozilla firefoxMozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2)...5.1 Medium
- standards based linux instrumentation sblim-sfcbThe SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for...6.9 Medium
- Show moreLoading…