CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- qtImproper Link Resolution Before File Access in QFileSystemEngine on Windows7.3 High
- No product listedImproper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver...7.3 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Installer Information Disclosure Vulnerability5.5 Medium
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability7.8 High
- google web designerRCE In Google Web Designer7.8 High
open-vm-toolsAlmaLinux,open-vm-tools-debuginfoRed Hat,open-vm-tools-debugsourceRed Hat +8 more +10 moreInsecure file handling vulnerability6.1 Medium- aira primePrivilege Escalation Vulnerability in Avira Prime Version 1.1.96.27.8 High
- avast cleanup premiumLink Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.178107.8 High
- avast cleanup premiumAvast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability7.8 High
- avg tuneupLink Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.47.8 High
- avg tuneupLink Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.98447.8 High
- avira primeLocal Privilege Escalation in Avira Prime 1.1.96.2 on Windows 10 x647.8 High
- avast cleanup, avg tuneup, norton utilities ultimate +2 moreLink Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)7.8 High
- docker desktopElevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion7.3 High
- hp touchpoint analytics service, hp, inc. hp touchpoint analytics service +1 moreHP Touchpoint Analytics Service – Potential Escalation of Privilege6.9 Medium
- sonicwall connect tunnelA Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and...6.1 Medium
- dell trusted device client, trusted device agent +1 moreDell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File...6.7 Medium
- sonicwall netextenderAn Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall...7.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Process Activation Elevation of Privilege Vulnerability7.8 High
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia...4.4 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...9.8 Critical
- metabaseMetabase vulnerable to circumvention of local link access protection in GeoJson endpoint2.1 Low
tar-fsnpm,node-tar-fsDebian,reaperAzure Linux +2 more +4 moretar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File7.5 High- microsoft edge update, edge update setup +1 moreMicrosoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability7.8 High
- binary-husky gpt academic, binary-husky/gpt academic +1 moreLocal File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academic8.8 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreRemote Code Execution in binary-husky/gpt_academic8.8 High
- dmlc dmlc/gluon-cvArbitrary File Write via TarSlip in dmlc/gluon-cv7.1 High
- 1e client, platform +1 moreSymbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion7.8 High
- microsoft windows server 2016, windows server 2016 (server core installation), windows server 2019 +6 more +8 moreWindows Server Elevation of Privilege Vulnerability7.1 High
- binary-husky gpt academicGPT Academic allows arbitary file read by tarfile uncompress within softlink7.5 High
- zoom communications, inc apps for macos, zoom meeting software development kit, rooms +2 more +4 moreZoom Apps for macOS - Symbolic Link Following5.4 Medium
- dell supportassist os recoveryDell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack...7.0 High
- cisco anyconnect secure mobility client, secure client +1 moreCisco AnyConnect Secure Mobility Client for Mac OS File Corruption Vulnerability5.6 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Deployment Services Denial of Service Vulnerability6.0 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Disk Cleanup Tool Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreWindows Setup Files Cleanup Elevation of Privilege Vulnerability7.1 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +24 more +26 moreWindows Storage Elevation of Privilege Vulnerability7.1 High
- microsoft azure network watcher vm extension, azure network watcher +1 moreAzure Network Watcher VM Extension Elevation of Privilege Vulnerability6.0 Medium
- parallels desktop, parallels, parallels remote application server +2 moreParallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability7.8 High
- zoom communications, inc workplace app for macos, zoom meeting software development kit, rooms +3 more +5 moreZoom Workplace app for macOS - Symlink Following3.9 Low
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...4.4 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with improved handling of symlinks. This issue is fixed in iPadOS 17.7.4...5.5 Medium
- hashicorp go-slug, shared library +1 moreHashiCorp go-slug Vulnerable to Zip Slip Attack7.5 High
- simple-help simplehelpSimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files...7.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows Installer Elevation of Privilege Vulnerability7.3 High
- Show moreLoading…