Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
594 results · Clear filters · Feed
-
High 8.7
Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the …
-
High 8.1
Arbitrary File Write in mudler/LocalAI
mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. …
-
High 7.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma …
-
High 7.1CVE-2024-44258 Public exploit
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 1…
-
High 7.8
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 1…
-
High 7.8
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.1
Azure Monitor Agent Elevation of Privilege Vulnerability
Azure Monitor Agent Elevation of Privilege Vulnerability
-
High 8.8
HP Hotkey Support – Escalation of Privilege
A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to updat…
-
High 7.8
Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and …
-
High 7.3
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
High 7.1
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
High 7.8
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execut…
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Azure Connected Machine Agent Elevation of Privilege Vulnerability
-
High 7.8
Microsoft OfficePlus Elevation of Privilege Vulnerability
Microsoft OfficePlus Elevation of Privilege Vulnerability
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Firewall Link Following Local Privilege Escalation Vulnerability
Comodo Firewall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Firewall. An attacker must first obtain the ability to execute low-privileged code on…
-
High 7.3
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 7.8
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
-
High 7.0
Windows Image Acquisition Elevation of Privilege Vulnerability
Windows Image Acquisition Elevation of Privilege Vulnerability
-
High 7.8
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileg…
-
High 7.1
Azure Monitor Agent Elevation of Privilege Vulnerability
Azure Monitor Agent Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office Remote Code Execution Vulnerability
-
High 7.3
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
-
High 7.8
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…
-
High 7.8
Avira Prime Link Following Local Privilege Escalation Vulnerability
Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avira Prime. An attacker must first obtain the ability to execute low-privileged code on the tar…
-
High 7.3
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the par…
-
High 7.8
Azure Monitor Agent Elevation of Privilege Vulnerability
Azure Monitor Agent Elevation of Privilege Vulnerability
-
High 7.0
Windows Search Service Elevation of Privilege Vulnerability
Windows Search Service Elevation of Privilege Vulnerability
-
High 7.8
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Arbitrary File Deletion in PaperCut NG/MF Web Print
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and …
-
High 7.8CVE-2023-50226 Public exploit
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privil…
-
High 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability…
-
High 7.8
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability t…
-
High 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability…
-
High 7.8
VIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation Vulnerability
VIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execu…
-
High 7.8
VIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability
VIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to exec…