CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn agent link vulnerability in the Trend Micro Apex One security agent could allow a local...7.8 High
- hypr workforce accessImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce...7.2 High
- hypr workforce accessImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce...6.4 Medium
- paxtechnology paydroid, pax technology pos terminals +1 morePAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can...7.8 High
- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Container privilege escalation8.4 High
- microsoft visual studio, visual studio 2015 update 3, visual studio 2017 version 15.9 (includes 15.0 - 15.8) +7 more +9 moreVisual Studio Elevation of Privilege Vulnerability7.8 High
- trellix anti-malware engineA symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January...7.1 High
- brother industries, ltd. iprint&scan desktop for windows, brother iprint\&scan +1 moreImproper link resolution before file access ('Link Following') issue exists in iPrint&Scan...5.5 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL...8.8 High
- buildkite elastic ci stackBuildkite Elastic CI for AWS symbolic link following vulnerability7.8 High
- microsoft azure connected machine agentAzure Connected Machine Agent Elevation of Privilege Vulnerability7.3 High
- microsoft windows 10 version 1507, windows server 2008 service pack 2, windows server 2008 r2 service pack 1 +9 more +11 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 22h3, windows 11 version 23h2, windows 11 23h2 +2 moreLocal Security Authority Subsystem Service Elevation of Privilege Vulnerability7.8 High
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry...4.3 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents...6.5 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete...8.1 High
- dell encryption, endpoint security suite enterprise, security management server +1 more +3 moreDell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server...4.6 Medium
- zoom rooms, zoom video communications, inc. rooms for macos +1 moreLink following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to...7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Authentication Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 21h2, windows 11 version 22h2, windows 11 version 22h3 +6 more +8 moreWindows Authentication Denial of Service Vulnerability7.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +14 more +16 moreWindows Search Service Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 21h2, windows 11 version 22h2, windows 11 version 22h3 +6 more +8 moreWindows Storage Elevation of Privilege Vulnerability7.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- froxlor, froxlor froxlor/froxlor +1 moreImproper Link Resolution Before File Access in froxlor/froxlor9.9 Critical
- hashicorp vagrantVagrant’s Windows Installer Allowed Directory Junction Write3.8 Low
- abus tvip 10000 firmware, tvip 10001 firmware, tvip 10005 firmware +44 more +46 moreDue to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video...7.5 High
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma...7.5 High
- jenkins cloudbees cd, jenkins project cloudbees cd plugin +1 moreJenkins CloudBees CD Plugin vulnerable to arbitrary file read6.5 Medium
- jenkins cloudbees cd, jenkins project cloudbees cd plugin +1 moreJenkins CloudBees CD Plugin vulnerable to arbitrary file deletion8.1 High
- zscaler client connectorLPE using arbitrary file delete with Symlinks6.3 Medium
- microsoft office, 365 apps, 365 apps for enterprise +3 more +5 moreMicrosoft Office Click-To-Run Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +20 more +22 moreWindows Runtime C++ Template Library Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +10 more +12 moreWindows Container Manager Service Elevation of Privilege Vulnerability7.8 High
- microsoft azure network watcher, azure network watcher vm extension +1 moreAzure Network Watcher VM Agent Elevation of Privilege Vulnerability7.8 High
- 1e client1E Client installer can perform arbitrary file deletion on protected files8.4 High
- apple ipados, macos, tvos +3 more +5 moreThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- microsoft visual studio 2022 version 17.7, visual studio 2022 +1 moreVisual Studio Elevation of Privilege Vulnerability7.8 High
- eclipse jgitImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write8.8 High
- wacom driver, drivers for windows +1 moreWacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability7.8 High
- acronis cyber protect home office, true image oem +1 moreLocal privilege escalation during installation due to improper soft link handling. The following...7.3 High
- google chromeInappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a...7.8 High
- techview la-5570 wireless gateway, jaycar la5570 firmware +1 moreAn issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain...7.5 High
- opensuse leap, suse linux enterprise high performance computing, opensuse leap 15.5 +3 more +5 moreA Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux...5.9 Medium
- ghostArbitrary file read via symlinks in Ghost4.9 Medium
- microsoft windows defender, windows defender antimalware platform +1 moreMicrosoft Windows Defender Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation), windows server 2008 +2 moreReliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows System Assessment Tool Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation), windows server 2008 +2 moreReliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability7.1 High
- rarlab unrarUnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.7.5 High
- nomachine enterprise client, free edition, nomachine +2 moreAn arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for...9.1 Critical
- Show moreLoading…