CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +4 more +6 moreWindows Search Service Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 10 21h2 +1 more +3 moreMicrosoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +15 more +17 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- papercut mf, ng, ng, papercut mf +2 moreArbitrary File Creation in PaperCut NG/MF Web Print Image Handler7.8 High
- papercut mf, ng, ng, papercut mf +2 moreArbitrary File Deletion in PaperCut NG/MF Web Print7.8 High
- samsung magicianAn issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the...6.7 Medium
- parallels desktopParallels Desktop Updater Link Following Local Privilege Escalation Vulnerability7.8 High
- intel driver & support assistant, driver\&support assistant, driver \& support assistant +2 moreIntel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability7.8 High
- bitdefender total securityG DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability7.8 High
- avast premium securityAvast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability7.8 High
- intel driver & support assistant, driver\&support assistant, driver \& support assistant +2 moreIntel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability7.8 High
- netgear rax30, rax30 firmware +1 moreNETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability4.6 Medium
- bitdefender antivirus plus, vipre antivirus +1 moreVIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation Vulnerability7.8 High
- bitdefender antivirus plus, vipre antivirus +1 moreVIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability7.8 High
- bitdefender antivirus plus, vipre antivirus +1 moreVIPRE Antivirus Plus Link Following Local Privilege Escalation Vulnerability7.8 High
- bitdefender total securityG DATA Total Security Link Following Local Privilege Escalation Vulnerability7.8 High
- zscaler client connectorMultiple Arbitrary Creates/Overwrites by link following7.1 High
- zscaler client connectorWindows ZCC Upgrade DoS And Privilege Escalation Through RPC Control5.3 Medium
- judge0Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link10.0 Critical
- judge0Judge0 vulnerable to Sandbox Escape via Symbolic Link10.0 Critical
- microsoft azure monitor, azure monitor agent +1 moreAzure Monitor Agent Elevation of Privilege Vulnerability8.4 High
- microsoft windows server 2022, 23h2 edition (server core installation), windows server 2022 23h2 +1 moreMicrosoft Brokering File System Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +14 more +16 moreWindows File Server Resource Management Service Elevation of Privilege Vulnerability7.3 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +11 more +13 moreWindows Authentication Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreMicrosoft Install Service Elevation of Privilege Vulnerability7.8 High
- apache cloudstackApache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences7.3 High
- dell powerscale onefsDell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink)...6.0 Medium
- dell powerscale onefsDell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink)...6.0 Medium
- zscaler client connectorZSATrayManager Arbitrary File Deletion7.3 High
- haxtheweb issuesMalicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files7.8 High
- microsoft xbox gaming servicesXbox Gaming Services Elevation of Privilege Vulnerability8.8 High
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 8.6 extended update support +9 more +11 moreBuildah: buildah: container escape via improper bind mount validation8.6 High
- canonical snapdsnapd will follow archived symlinks when unpacking a filesystem4.8 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +25 more +27 moreWindows Update Stack Elevation of Privilege Vulnerability7.0 High
- microsoft 365 apps, 365 apps for enterprise +1 moreMicrosoft Office Elevation of Privilege Vulnerability7.8 High
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma...5.5 Medium
- hypr workforce accessImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1,...7.8 High
- microsoft azure file syncMicrosoft Azure File Sync Elevation of Privilege Vulnerability5.3 Medium
- microsoft azure connected machine agentAzure Connected Machine Agent Elevation of Privilege Vulnerability7.3 High
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Arbitrary Write Through Symlink Attack7.7 High
- dell dup framework, update package framework +1 moreDUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount...6.3 Medium
- dell display managerDell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on...6.6 Medium
- gnu cpio, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreCpio: extraction allows symlinks which enables remote command execution5.3 Medium
- mate-desktop engrampaPath traversal via crafted cpio archives in Engrampa archivers8.2 High
- trendmicro deep security, trend micro, inc. micro deep security agent, trendmicro deep security agent +2 moreA link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One -...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn updater link following vulnerability in the Trend Micro Apex One agent could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA security agent link following vulnerability in Trend Micro Apex One could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA security agent link following vulnerability in Trend Micro Apex One could allow a local...7.8 High
- Show moreLoading…