Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
594 results · Clear filters · Feed
-
High 7.8CVE-2023-36723 Public exploit
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
High 7.8
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
High 8.4
1E Client installer can perform arbitrary file deletion on protected files
1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A …
-
High 7.8
Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
-
High 8.8
Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cl…
-
High 7.8CVE-2023-32163 Public exploit
Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability
Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute lo…
-
High 7.8
Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perf…
-
High 7.8
Microsoft Windows Defender Elevation of Privilege Vulnerability
Microsoft Windows Defender Elevation of Privilege Vulnerability
-
High 7.8
Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability
Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability
-
High 7.8
Windows System Assessment Tool Elevation of Privilege Vulnerability
Windows System Assessment Tool Elevation of Privilege Vulnerability
-
High 7.1
Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability
Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability
-
High 7.8
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
KEV Jul 11, 2023 -
High 7.8
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
-
High 7.1
Microsoft Install Service Elevation of Privilege Vulnerability
Microsoft Install Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Image Acquisition Elevation of Privilege Vulnerability
Windows Image Acquisition Elevation of Privilege Vulnerability
-
High 7.8
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-33148 Public exploit
Microsoft Office Elevation of Privilege Vulnerability
Microsoft Office Elevation of Privilege Vulnerability
-
High 7.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
High 8.1
Windows Group Policy Elevation of Privilege Vulnerability
Windows Group Policy Elevation of Privilege Vulnerability
-
High 7.8
RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory…
-
High 7.8
Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker t…
-
High 8.8
Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code executio…
-
High 7.8
Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vuln…
-
High 7.1
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-29343 Public exploit
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
-
High 7.1
Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/c…
-
High 7.1
Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 A…
-
High 7.1
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.3CVE-2022-38604 Public exploit
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
-
High 7.0
Local Privilege Escalation in Cloudflare WARP Installer (Windows)
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, ove…
-
High 7.0
Local Privilege Escalation Vulnerability in WARP's MSI Installer
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oploc…
-
High 7.5
Local Privilege Escalation Vulnerability in cloudflared's Installer
A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the…
-
High 7.8
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
-
High 7.8
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulne…
-
High 7.8
A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarant…
-
High 7.8
A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to e…
-
High 8.4
Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resou…