CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreThe Firefox updater created a directory writable by non-privileged users. When uninstalling...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFull screen notification obscured by external program6.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +10 more +12 moreWindows Server Update Service (WSUS) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +27 more +29 moreWindows Error Reporting Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +14 more +16 moreConnected User Experiences and Telemetry Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +6 more +8 moreMicrosoft Install Service Elevation of Privilege Vulnerability7.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Image Acquisition Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +14 more +16 moreConnected User Experiences and Telemetry Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +3 more +5 moreWindows Installer Elevation of Privilege Vulnerability7.0 High
- microsoft office, 365 apps, 365 apps for enterprise +4 more +6 moreMicrosoft Office Elevation of Privilege Vulnerability7.8 High
- mozilla firefoxUploading files which contain symlinks may have allowed an attacker to trick a user into...6.5 Medium
- malwarebytes anti-exploitMalwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of...7.1 High
- trend micro apex one, trend micro, inc. micro apex one +1 moreA link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could...5.5 Medium
- dell alienware update, update, command update +1 more +3 moreDell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an...6.7 Medium
- dell alienware update, update, command update +1 more +3 moreDell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain...6.3 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +5 more +7 moreWindows Container Manager Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Group Policy Elevation of Privilege Vulnerability8.1 High
- renderdocRenderDoc through 1.26 allows local privilege escalation via a symlink attack.7.8 High
- google chromeInsufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90...7.8 High
- imapsync project imapsyncimapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of...6.5 Medium
- minecraftMinecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and...8.8 High
- wacom tablet driver installerWacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution...7.8 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +3 more +5 moreWindows Installer Elevation of Privilege Vulnerability7.1 High
- microsoft windows sysmonSysInternals Sysmon for Windows Elevation of Privilege Vulnerability7.8 High
- docker desktopDocker Desktop for Windows before 4.6 allows attackers to overwrite any file through the...6.3 Medium
- docker desktopDocker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink...7.1 High
- docker desktopDocker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv...7.1 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Local Privilege Escalation Vulnerability7.8 High
- qualys cloud agentNTFS Junction6.7 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: NFX Series: 'set system ports console insecure' allows root password recovery6.8 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Kernel Elevation of Privilege Vulnerability7.1 High
- wacom driverWacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability...5.9 Medium
- wacom driverWacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion...7.3 High
- cloudflare warpLocal Privilege Escalation in Cloudflare WARP Installer (Windows)7.0 High
- cloudflare warpLocal Privilege Escalation Vulnerability in WARP's MSI Installer7.0 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access...6.7 Medium
- generex ups cs141, cs141 firmware +1 moreImproper Input Validation in Generex CS1417.5 High
- malwarebytes adwcleanerMalwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete...7.8 High
- linuxfoundation runcAppArmor bypass with symlinked /proc in runc6.1 Medium
- malwarebytesIn Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the...7.8 High
- cloudflare cloudflaredLocal Privilege Escalation Vulnerability in cloudflared's Installer7.5 High
- microsoft onedrive, onedrive for macos installer +1 moreMicrosoft OneDrive for MacOS Elevation of Privilege Vulnerability7.8 High
- mcafee total protectionMcAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to...5.5 Medium
- netgear rax30 firmwareNETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows...6.8 Medium
- trend micro apex one, trend micro, inc. micro apex one +1 moreA security agent link following vulnerability in Trend Micro Apex One could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one +1 moreA security agent link following vulnerability in the Trend Micro Apex One agent could allow a...7.8 High
- trend micro apex one, trend micro, inc. micro apex one +1 moreA link following vulnerability in the scanning function of Trend Micro Apex One agent could allow...7.8 High
- razer centralArbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the...7.8 High
- apple macos, mac os x +1 moreA validation issue existed in the handling of symlinks. This issue was addressed with improved...5.5 Medium
- Show moreLoading…