CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- eternal terminal project terminalIn Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local...6.3 Medium
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8), visual studio 2019 version 16.11 (includes 16.0 - 16.10), visual studio 2022 version 17.0 +5 more +7 moreVisual Studio Denial of Service Vulnerability5.6 Medium
- microsoft .net framework, .net framework 2.0 service pack 2, .net framework 3.0 service pack 2 +9 more +11 more.NET Framework Denial of Service Vulnerability5.0 Medium
- gitGit vulnerable to local clone-based data exfiltration with non-local transports5.5 Medium
- dell command \| intel vpro out of band, command update (dcu) +1 moreDell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete...4.7 Medium
- dell command \| integration suite for system center, command integration suite for system center (dcis) +1 moreDell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary...4.7 Medium
- pterodactyl wingsSymbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings9.6 Critical
- pterodactyl wingsSymbolic Link (Symlink) Following in github.com/pterodactyl/wings8.4 High
- nvidia geforce experienceNVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user...5.0 Medium
- nvidia geforce experienceNVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the...8.2 High
- uptimed project uptimeduptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to...7.8 High
- cisco roomos software, roomos, telepresence endpoint software (tc/ce) +2 more +4 moreA vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an...4.4 Medium
- zyxel ax7501-b0 firmwareA vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0...4.4 Medium
- samba, fedoraproject fedora +1 moreA symlink following vulnerability was found in Samba, where a user can create a symbolic link...6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Print Spooler Elevation of Privilege Vulnerability7.1 High
- microsoft windows malicious software removal toolWindows Malicious Software Removal Tool Elevation of Privilege Vulnerability6.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Print Spooler Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 7 +18 more +20 moreWindows Installer Elevation of Privilege Vulnerability7.0 High
- mega hopexA link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.4.3 Medium
- ziparchive ssziparchive, ziparchive project ziparchive +1 moreSSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when op…8.1 High
- microsoft binwalkReFirm Labs binwalk Archive Extraction extractor.py symlink5.0 Medium
- trend micro apex one, trend micro, inc. micro apex one +1 moreA link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and...7.8 High
- freedom securedropFreedom of the Press SecureDrop gpg-agent.conf symlink7.8 High
- containers podman, fedoraproject fedora +1 moreBuildah (as part of Podman) vulnerable to Link Following5.3 Medium
- vmware open-vm-toolsAn issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended...7.0 High
- vmware open vm toolsAn issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a...6.7 Medium
- hp inc. print products and digital sending products, hp color laserjet cm4540 mfp cc419a firmware, color laserjet cm4540 mfp cc420a firmware +2,692 more +2,694 moreCertain HP Print products and Digital Sending products may be vulnerable to potential remote code...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be...8.8 High
- acronis cyber protect home officeLocal privilege escalation due to improper soft link handling. The following products are...2.2 Low
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...7.8 High
- opensuse factory, suse opensuse factory +1 moresendmail: mail to root privilege escalation via sm-client.pre script7.7 High
- opensvc multipath-tools, debian linux, fedoraproject fedora +2 moremultipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as...7.8 High
- git, apple xcode, debian linux +1 more +3 moreGit subject to exposure of sensitive information via local clone of symbolic links5.5 Medium
- linuxmint warpinatorWarpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by...7.5 High
- trend micro deep security, trend micro, inc. micro deep security, trendmicro deep security agent +2 moreA link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security...7.8 High
- asus armoury crate serviceASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw5.9 Medium
- zte zxa10 b700v7 firmware, zxa10 b710c-a12 firmware, zxa10 b710s2-a19 firmware +12 more +14 moreThere is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission...9.1 Critical
- trend micro apex oneA link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro...7.3 High
- trendmicro security, trend micro security (consumer), trend micro, inc. micro security (consumer) +2 moreTrend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with...7.8 High
- palo alto networks cortex xdr agentCortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support File5.5 Medium
- rust-lang cargoExtracting malicious crates can corrupt arbitrary files4.6 Medium
- google android, mediatek, inc. mt6769, mt6781, mt6785, mt6789, mt6833, mt6853, mt6855, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt6983, mt8185, mt8789, mt8791, mt8797 +1 moreIn vow, there is a possible information disclosure due to a symbolic link following. This could...4.4 Medium
- measuresoft scadapro server and client, scadapro server, scadapro client +2 moreMeasuresoft ScadaPro Server and Client Link Following6.1 Medium
- measuresoft scadapro server and client, scadapro server, scadapro client +2 moreMeasuresoft ScadaPro Server and Client Link Following7.8 High
- red hat, inc. rpm, redhat enterprise linux +1 moreIt was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only...6.7 Medium
- mikrotik routerosThe container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points...9.8 Critical
- red hat, inc. rpm, fedoraproject fedora, redhat enterprise linux +2 moreA symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and...6.7 Medium
- red hat, inc. rpm, fedoraproject fedora, redhat enterprise linux +2 moreA race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to...6.4 Medium
- tauriThe readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri8.3 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +1 more +3 moreA link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free...7.8 High
- Show moreLoading…