CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- canonical snapd, ubuntu linux, debian linux +1 more +3 moresnapd could be made to escalate privileges and run programs as administrator7.8 High
- jenkins project pipeline: shared groovy libraries plugin, jenkins pipeline\ +1 moreImproper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin6.5 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreImproper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin6.5 Medium
- jenkins project pipeline: multibranch plugin, jenkins pipeline\ +1 moreLink Following in Jenkins Pipeline Multibranch Plugin6.5 Medium
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation7.0 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +35 more +37 moreWindows Print Spooler Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Print Spooler Elevation of Privilege Vulnerability7.1 High
- juceLink Following5.5 Medium
- samba, fedoraproject fedora, redhat storage +2 moreAll versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink...4.3 Medium
- leostream connection brokerLeostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal...4.9 Medium
- opensuse factory, factory watchman, backports sle-15-sp3 +2 morewatchman: chown in watchman@.socket unit allows symlink attack7.8 High
- palo alto networks cortex xdr agentCortex XDR Agent: Local Arbitrary File Deletion Vulnerability6.1 Medium
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +35 more +37 moreWindows User Profile Service Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +17 more +19 moreWindows User Profile Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows Cleanup Manager Elevation of Privilege Vulnerability5.5 Medium
- trend micro worry-free business security, trend micro, inc. micro worry-free business security, trendmicro apex one +1 more +3 moreA link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on...7.1 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +1 more +3 moreA link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS)...7.8 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +1 more +3 moreA link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and...7.1 High
- trendnet tew-827dru firmwareTrendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent...6.8 Medium
- iris-go irisArbitrary File Write7.5 High
- debian linux, fedoraproject fedora, libarchive +11 more +13 moreAn improper link resolution flaw can occur while extracting an archive leading to changing modes,...7.8 High
- debian linux, fedoraproject fedora, libarchive +10 more +12 moreAn improper link resolution flaw while extracting an archive can lead to changing the access...7.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ security 2021 +3 more +5 moreA link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer)...7.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreWindows Remote Access Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1909, windows 10 version 2004, windows 10 version 20h2 +10 more +12 moreWindows Setup Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 update assistant, windows update assistant +1 moreWindows 10 Update Assistant Elevation of Privilege Vulnerability5.0 Medium
- quaggaAn issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested...7.8 High
- wibu codemeter runtime, siemens pss cape, pss e +7 more +9 moreIn WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite...7.1 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +36 more +38 moreWindows Installer Elevation of Privilege Vulnerability5.5 Medium
- bitdefender gravityzoneImproper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)6.1 Medium
- jenkinsMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins8.8 High
- jenkinsMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins9.8 Critical
- jenkinsMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins8.1 High
- huawei emui, magic ui +1 moreThere is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation...7.5 High
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54...7.8 High
- dell supportassist client consumerDell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain...7.1 High
- zoom meetings, zoom video communications inc client for meetings for windows +1 moreThe Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to...7.8 High
- cisco ios xe sd-wan software, sd-wan +1 moreCisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability5.5 Medium
- mcafee endpoint security, mcafee,llc mcafee endpoint security (ens) for windows +1 moreImproper access control vulnerability in McAfee ENS for Windows7.3 High
- squashfs-tools project squashfs-tools, debian linux +1 moresquashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different...8.1 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro maximum security 2019 +3 more +5 moreTrend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction...7.8 High
- npm arborist, oracle graalvm, siemens sinec infrastructure network services +2 moreUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 High
- npm arborist, oracle graalvm, siemens sinec infrastructure network services +2 moreUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 High
- isaacs node-tar, npmjs tar, debian linux +2 more +4 moreArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 High
- isaacs node-tar, npmjs tar, debian linux +2 more +4 moreArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability6.0 Medium
- apple macos, tvos, watchos +3 more +5 moreA validation issue related to hard link behavior was addressed with improved sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008…5.5 Medium
- apple ipados, macos, watchos +3 more +5 moreA validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.…5.5 Medium
- bblfsh bblfshdZipSlip vulnerability in bblfshd2.7 Low
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +18 more +20 moreWindows User Account Profile Picture Elevation of Privilege Vulnerability7.0 High
- Show moreLoading…