CWE-64: Windows Shortcut Following (.LNK)
The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Also known as Windows symbolic link following, symlink.
A kind of CWE-59 insecure temporary file.
From the CWE List. © The MITRE Corporation.
Newest
- mitsubishi electric corporation analytix, genesis, genesis64 +5 more +7 more Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS 5.9 Medium
- trend micro, inc. micro cleaner one pro, trendmicro cleaner one +1 more Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could... 7.8 High
- trend micro, inc. micro password manager, trendmicro password manager +1 more Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link... 7.8 High
- trend micro, inc. micro security (consumer), trendmicro maximum security 2022 +1 more Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation... 7.8 High
- trend micro, inc. micro internet security (consumer), trendmicro maximum security 2022 +1 more Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation... 7.8 High
- trend micro, inc. micro internet security (consumer), trendmicro maximum security 2022 +1 more Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation... 7.8 High
- trend micro, inc. micro password manager, trendmicro password manager +1 more Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link... 6.7 Medium
- snow agent for windows, snowsoftware snow inventory agent +1 more Deletion of arbitrary files vulnerability in Snow Agent for Windows 6.1 Medium
- beego Cross-site Scripting in Beego 6.1 Medium
- tiny tinymce Cross-site scripting vulnerability in TinyMCE plugins 6.1 Medium
- cisco duo authentication proxy, duo authentication proxy +1 more Duo Authentication Proxy Installer Denial of Service Vulnerability 6.6 Medium
-
bootboxnpm Cross-Site Scripting in bootbox No score - hackerone html-pages Cross-Site Scripting in html-pages 6.1 Medium
- jquery Cross-Site Scripting in jquery 6.1 Medium