CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- redhat enterprise linux desktop, enterprise linux hpc node, enterprise linux hpc node eus +4 more +6 moreThe Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local...5.5 Medium
- linuxcontainers lxclxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink...4.9 Medium
- zarafa collaboration platformprovider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x...6.6 Medium
- gnu parallel, opensuse +1 moreGNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows...3.6 Low
- gnu parallelGNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) -...3.6 Low
- docker libcontainer, opensuse +1 moreArbitrary File Write in Libcontainer7.8 High
- docker, docker libcontainer +1 moreSymlink Attack in Libcontainer and Docker Engine7.2 High
- apple os x, mac os x +1 moreThe XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to...7.8 High
- arj software archiver, fedoraproject fedora +1 moreOpen-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks...5.8 Medium
- samba rsync, opensuse, oracle solaris +2 morersync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in...6.4 Medium
- webminThe Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink...4.9 Medium
- apple iphone os, tvos +1 moreDirectory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple...10.0 High
- pax project paxpax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an...4.3 Medium
- 7-zip p7zip, fedoraproject fedora, oracle solaris +2 morep7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.5.8 Medium
- gnu patch, opensuse, oracle solaris +2 moreGNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a...4.3 Medium
- typo3Typo3 Open Redirect In Frontend Rendering4.3 Medium
- dockerDirectory Traversal in Docker6.4 Medium
- dockerArbitrary Code Execution in Docker7.5 High
- nagioslib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a...2.1 Low
- apache hadoopImproper Link Resolution Before File Access in Apache Hadoop5.0 Medium
- w3eden download managerDirectory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows...5.0 Medium
- debian apt, advanced package tool +1 moreThe changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a...3.6 Low
- php, opensuse evergreen, opensuse +1 more +3 moreThe PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to...3.6 Low
- apple iphone os, tvos +1 moresyslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to...3.6 Low
- codeaurora android-msmThe Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android...3.3 Low
- vmware tools, vm-support, workstation +2 morevm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other...6.3 Medium
- saltstack saltSaltStack Salt Insecure Temporary File Creation7.2 High
- xml-dt project xml-dtThe (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite...6.3 Medium
- gnu readline, fedoraproject fedora, mageia +1 more +3 moreThe _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create...3.3 Low
- linux kernel, redhat enterprise linux eus, enterprise linux server aus +1 more +3 moreThe mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly...6.2 Medium
- apache subversionThe daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges...2.4 Low
- apache subversionsvnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in...2.4 Low
- apple cups, canonical ubuntu linux +1 moreCUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html...1.9 Low
- apple cups, canonical ubuntu linux +1 moreThe web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a...1.5 Low
- apple cups, canonical ubuntu linux, fedoraproject fedora +2 moreThe web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files...1.2 Low
- redhat cloudforms 3.0 management engineThe (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib...6.9 Medium
- ppc64-diag project ppc64-diag, redhat enterprise linux server, suse linux enterprise server +2 moreppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to ...4.4 Medium
- s48 scheme48The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write...5.5 Medium
- fail2banThe (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf...4.7 Medium
- ibm aix, vios +1 morelibodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files...6.9 Medium
- cisofy lynisinclude/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files...3.3 Low
- cisofy lynisinclude/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary...3.3 Low
- phpacinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to...3.3 Low
- travis shirk eyed3, opensuse +1 moreeyeD3 is vulnerable to arbitrary file modification via symlink attack3.3 Low
- gnu emacs, mageia project mageia +1 morelisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary...3.3 Low
- gnu emacs, mageia project mageia +1 morelisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary...3.3 Low
- gnu emacs, mageia project mageia +1 morelisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite...3.3 Low
- gnu emacs, mageia project mageia +1 morelisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary...3.3 Low
- nagios pluginsThe IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to...4.4 Medium
- david leonard pkstattmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack...6.3 Medium
- Show moreLoading…