CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- rapid7 velociraptorFilesystem race on temporary files5.5 Medium
- opensuse tumbleweedkeylime %post scriplet allows for privilege escalation from keylime user to root7.1 High
- anydeskAnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user...7.1 High
- swtpm project swtpmIn swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary...7.1 High
- google android, mediatek, inc. mt6781, mt6877, mt6879, mt6893, mt6895, mt6983, mt8791, mt8797, mt8798 +1 moreIn sound driver, there is a possible information disclosure due to symlink following. This could...6.7 Medium
- cloudflare warpCloudlfare WARP Arbitrary File Overwrite5.8 Medium
- thalesgroup safenet authentication clientThales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure...6.7 Medium
- argoproj argo cd, argo-cd +1 moreSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-server4.3 Medium
- comodo antivirusComodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate...7.8 High
- argo events project eventsDirectory Traversal7.5 High
- yandex browserLocal privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local,...7.8 High
- yandex browserLocal privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local,...7.8 High
- abb drive composer, automation builder, drive composer entry +2 more +4 moreDrive Composer Link Following Local Privilege Escalation Vulnerability7.3 High
- abb drive composer, automation builder, drive composer entry +2 more +4 moreDrive Composer Link Following Local Privilege Escalation Vulnerability7.8 High
- abb drive composer, automation builder, drive composer entry +2 more +4 moreDrive Composer Link Following Local Privilege Escalation Vulnerability7.8 High
- abb drive composer, automation builder, drive composer entry +2 more +4 moreDrive Composer Link Following Local Privilege Escalation Vulnerability7.8 High
- denoLink Following in Deno8.4 High
- trend micro maximum security, trendmicro maximum security 2022 +1 moreTrend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could...7.1 High
- apple macos, mac os x +1 moreA validation issue existed in the handling of symlinks and was addressed with improved validation...7.8 High
- apple macos, mac os x +1 moreAn issue in the handling of symlinks was addressed with improved validation. This issue is fixed...4.4 Medium
- hashicorp go-getterHashiCorp go-getter unsafe downloads8.6 High
- quickheal total securityTOCTOU Vulnerability in Quick Heal Total Security7.9 High
- checkmkIn Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can...8.2 High
- argoproj argo cd, argo-cd +1 moreSymlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server4.3 Medium
- trend micro password manager, trend micro, inc. micro password manager +1 moreTrend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link...7.8 High
- check point endpoint security client for windows, checkpoint endpoint security +1 moreCheck Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for...7.8 High
- debian linux, rarlab unrar +1 moreRARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an...7.5 High
- qnap qts, quts hero, qutscloud +2 moreArbitrary file read6.5 Medium
- google android, mediatek, inc. mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8163, mt8167, mt8168, mt8173, mt8185, mt8321, mt8362a, mt8365, mt8735, mt8735b, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn aee daemon, there is a possible information disclosure due to symbolic link following. This...4.4 Medium
- google android, mediatek, inc. mt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8675, mt8696, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn netdiag, there is a possible symbolic link following due to an improper link resolution. This...6.7 Medium
- linksys mr9600 firmwareLinksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link...4.6 Medium
- cisco ios, ios xe +1 moreCisco IOx Application Hosting Environment Vulnerabilities5.5 Medium
- mcafee agent, mcafee,llc mcafee agent for windows +1 moreImproper Privilege Management in McAfee Agent for Windows7.8 High
- vmware horizon, horizon agent for linux +1 moreVMware Horizon Client for Linux (prior to 22.x) contains a local privilege escalation as a user...7.8 High
- google android, mediatek, inc. mt6731, mt6732, mt6735, mt6737, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6795, mt6799, mt6833, mt6853t, mt6873, mt6875, mt6877, mt6880, mt6883, mt6885, mt6889, mt6890, mt6891, mt6893, mt6985, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8667, mt8675, mt8735a, mt8735b, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn mobile_log_d, there is a possible symbolic link following due to an improper link resolution....6.7 Medium
- trend micro antivirus for macA link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to...7.3 High
- apache hadoopArbitrary file write in FileUtil#unpackEntries on Windows9.8 Critical
- beegoPrivilege escalation in beego7.8 High
- beegoPrivilege escalation in beego7.8 High
- waycrate swhkdData Loss/Denial of Service in SWHKD7.1 High
- waycrate swhkdInsecure Temporary File in SWHKD7.8 High
- docker desktopDocker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any...7.1 High
- netatalk, western digital my cloud, my cloud home +12 more +14 moreWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk10.0 Critical
- apple ipados, macos, tvos +3 more +5 moreAn issue existed within the path validation logic for symlinks. This issue was addressed with...7.5 High
- google android, mediatek, inc. mt6762, mt6765, mt6768, mt6769, mt6779, mt6781, mt6785, mt6795, mt6797, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6880, mt6883, mt6885, mt6889, mt6891, mt6893, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8667, mt8675, mt8696, mt8735a, mt8735b, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn connsyslogger, there is a possible symbolic link following due to improper link resolution....6.7 Medium
- google chromeInsufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51...8.8 High
- asus rog live service, armoury crate & aura creator installer (rog live service) +1 moreASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access7.7 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +1 more +3 moreA security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend...7.8 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +1 more +3 moreA security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend...7.8 High
- trendmicro antivirus, trend micro antivirus for mac +1 moreA link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150...7.8 High
- Show moreLoading…