CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows Event Tracing Elevation of Privilege Vulnerability7.8 High
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to...9.1 Critical
- zte zxhn h2640 firmwareThere is an information leak vulnerability in the digital media player (DMS) of ZTE's residential...2.4 Low
- isaacs node-tar, tar project tar, oracle graalvm +1 more +3 moreArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning8.2 High
- opensuse factory, suse linux enterprise server, opensuse factory +2 more +4 moreclone-master-clean-up: dangerous file system operations3.2 Low
- replaysorcery project replaysorceryreplay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a...7.8 High
- nvidia gpu display driverNVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel...7.1 High
- nvidia gpu display driverNVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can...7.1 High
- debian linux, fedoraproject fedora, php archive tar +2 moreDirectory Traversal in Archive_Tar7.1 High
- tar project tarLinks in archive can create arbitrary directories7.5 High
- fortinet forticlient, forticlientmac +1 moreAn improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged...6.7 Medium
- dell storage managerQSAN Storage Manager - UNIX Symbolic Link (Symlink) Following7.5 High
- dell storage managerQSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc function6.5 Medium
- dell storage managerQSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming function6.5 Medium
- opensuse factory, leap 15.2, suse arpwatch +3 more +5 morearpwatch: Local privilege escalation from runtime user to root7.8 High
- ibm db2, db2 for linux and unix +1 moreIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user...6.2 Medium
- opensuse factory, leap 15.2, python-hyperkitty project python-hyperkitty +2 morepython-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root6.8 Medium
- opensuse factory, leap 15.2, python-postorius +2 morepython-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root6.8 Medium
- intel driver \& support assistantImproper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow...7.8 High
- pleaseedit project pleaseeditPermissions bypass in pleaser7.8 High
- openvpn private tunnelPrivate Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical...7.8 High
- acronis true image 2020An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe...7.8 High
- canonical apportapport process_report() arbitrary file write5.2 Medium
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, oracle openjdk, canonical ubuntu linux +2 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- canonical apport, ubuntu linux +1 moreapport read_file() function could follow maliciously constructed symbolic links7.3 High
- redhat openshift container platformA Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file...7.1 High
- mcafee endpoint security for linux threat prevention, mcafee,llc mcafee endpoint security (ens) for linux +1 moreBy exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security...8.2 High
- mcafee total protection, mcafee,llc mcafee total protection (mtp) +1 morePrivilege Escalation vulnerability in McAfee Total Protection (MTP)7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1803 +5 more +7 moreWindows WalletService Elevation of Privilege Vulnerability7.8 High
- eximExim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root...7.8 High
- gnu guix, gnu guix guix-daemon +1 moreLocal privilege escalation in GNU Guix via guix-daemon and '--keep-failed'5.5 Medium
- checkpoint identity agentA denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000,...8.1 High
- forescout counteractAn issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation...7.8 High
- microsoft visual studio 2015 update 3, visual studio 2017 version 15.9 (includes 15.0 - 15.8), visual studio 2019 version 16.4 (includes 16.0 - 16.3) +17 more +19 moreDiagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability7.8 High
- vestacp control panelVestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for...7.8 High
- gnome file-roller, fedoraproject fedora +1 morefr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other...3.9 Low
- eclipse jetty, the eclipse foundation eclipse jetty, apache ignite +21 more +23 moreDirectory exposure in jetty2.7 Low
- openvpn connectOpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it...7.1 High
- avast premium securityThis vulnerability allows local attackers to delete arbitrary directories on affected...6.1 Medium
- gnu binutils, broadcom brocade fabric operating system firmware, netapp cloud backup +3 more +5 moreThere is an open race window when writing output in the following utilities in GNU binutils...6.3 Medium
- mcafee data loss prevention, mcafee,llc mcafee data loss prevention (dlp) endpoint for windows +1 morePrivilege escalation in McAfee DLP Endpoint for Windows7.8 High
- gnome gnome-autoar, fedoraproject fedora +1 moreautoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and...5.5 Medium
- gnome glib, broadcom brocade fabric operating system firmware, debian linux +4 more +6 moreAn issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with...5.3 Medium
- Show moreLoading…