CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- safervpnSaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite...8.1 High
- avast secureline vpnThe VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary...5.5 Medium
- microsoft onedrive, onedrive for windows +1 moreOneDrive for Windows Elevation of Privilege Vulnerability7.1 High
- microsoft onedrive, onedrive for windows +1 moreOneDrive for Windows Elevation of Privilege Vulnerability7.1 High
- canonical ubuntu-ui-toolkitInsecure temp file usage in Ubuntu UI toolkit3.8 Low
- mcafee mvision endpointPrivilege Escalation vulnerability in MVISION Endpoint5.5 Medium
- mcafee endpoint security, bitdefender endpoint security for windows +1 moreImproper Access Control Vulnerability in ENS for Windows8.8 High
- raszi tmp, node-tmp +1 moretmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter2.5 Low
- superantispyware professional xSUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation...7.8 High
- trend micro apex one, worry-free business security, trendmicro worry-free business security services +2 more +4 moreA vulnerability in Trend Micro Apex One on macOS may allow an attacker to manipulate a certain...7.8 High
- trend micro apex one, officescan, worry-free business security +2 more +4 moreA vulnerability in Trend Micro Apex One and OfficeScan XG SP1 on Microsoft Windows may allow an...7.8 High
- canonical checkinstallcheckinstall 1.6.2, when used to create a package that contains a symlink, may trigger the...7.8 High
- kde ark, canonical ubuntu linux, debian linux +2 more +4 moreIn KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the...3.3 Low
- chrony, canonical ubuntu linux, fedoraproject fedora +2 moreA flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run...6.0 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local...7.8 High
- abbyy finereaderABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows...7.8 High
- trustedcomputinggroup trousers, fedoraproject fedora +1 moreAn issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...5.5 Medium
- checkpoint zonealarm anti-ransomwareZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory...7.4 High
- net-snmp, canonical ubuntu linux, netapp cloud backup +2 more +4 moreNet-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink)...7.8 High
- ncp-e secure enterprise clientNCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via...7.8 High
- overwolfOverwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of...8.8 High
- adobe creative cloud desktop applicationAdobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability...9.8 Critical
- adobe creative cloud desktop applicationAdobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability...9.8 Critical
- cisco sd-wan vmanage, sd-wan firmware +1 moreCisco SD-WAN vManage Software Information Disclosure Vulnerability6.5 Medium
- mcafee total protection, mcafee,llc mcafee total protection (mtp) +1 morePrivilege Escalation vulnerability in McAfee Total Protection (MTP)7.5 High
- obdev little snitchLittle Snitch version 4.5.1 and older changed ownership of a directory path controlled by the...8.8 High
- iobit malware fighterIOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by...4.4 Medium
- iobit advanced systemcareIOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion...7.1 High
- icinga, opensuse backports sle, leap +2 moreAn issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of...7.8 High
- kata containers containers, katacontainers runtime, fedoraproject fedora +2 moreKata Containers - Guests can trick the kata-runtime into mounting the container image on any host path7.8 High
- bitdefender antivirus free, antivirus 2020 +1 moreLink Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)7.2 High
- google androidAn issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The...9.1 Critical
- cisco ioxCisco IOx Application Framework Arbitrary File Overwrite Vulnerability6.3 Medium
- cisco ios xe, ios xe software 16.9.4 +1 moreCisco IOS XE Software Web UI Arbitrary File Read Vulnerability4.5 Medium
- synk brokerArbitrary File Read in Snyk Broker6.5 Medium
- google chrome, fedoraproject fedora, opensuse backports sle +1 more +3 moreInappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed...7.8 High
- kata containers containers, katacontainers runtime +1 moreKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host6.5 Medium
- symantec endpoint protectionSymantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log...7.8 High
- zoom it installerThe MSI installer in Zoom before 4.6.10 on Windows follows Symbolic Links.8.1 High
- eset antivirus and antispyware, endpoint antivirus, endpoint security +5 more +7 moreESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access...7.8 High
- decompress project decompressPath Traversal in decompress9.8 Critical
- avira antivirusAvira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of...7.8 High
- avg antivirus free, bitdefender antivirus 2020 +1 moreLink Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)7.1 High
- sophos anti-virus for sophos central, anti-virus for sophos home +1 moreMac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow...8.8 High
- sierrawireless mobile broadband driver packageThe Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an...7.8 High
- mcafee endpoint security, mcafee llc endpoint security (ens), mcafee, llc mcafee endpoint security (ens) +2 moreENS symbolic link log file manipulation vulnerability8.2 High
- grandstream gxp1610 firmware, gxp1615 firmware, gxp1620 firmware +3 more +5 moreGrandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote...8.8 High
- gnome file-roller, canonical ubuntu linux, debian linux +2 morefr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during...3.9 Low
- facebook oculus desktop, oculus desktop +1 moreWriting to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1...7.8 High
- exim, opensuse factory +1 moreLocal privilege escalation in exim package from user mail to root8.4 High
- Show moreLoading…