Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
1,132 results · Feed
-
High 7.3
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
High 7.1
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
Medium 6.7
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resul…
-
High 7.8
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execut…
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Azure Connected Machine Agent Elevation of Privilege Vulnerability
-
High 7.8
Microsoft OfficePlus Elevation of Privilege Vulnerability
Microsoft OfficePlus Elevation of Privilege Vulnerability
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the abilit…
-
High 7.8
Comodo Firewall Link Following Local Privilege Escalation Vulnerability
Comodo Firewall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Firewall. An attacker must first obtain the ability to execute low-privileged code on…
-
Medium 4.8
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the s…
-
High 7.3
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 7.8
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
-
High 7.0
Windows Image Acquisition Elevation of Privilege Vulnerability
Windows Image Acquisition Elevation of Privilege Vulnerability
-
Medium 6.7
Microsoft Windows Server Backup Elevation of Privilege Vulnerability
Microsoft Windows Server Backup Elevation of Privilege Vulnerability
-
High 7.8
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileg…
-
Medium 6.7
Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportuni…
-
High 7.1
Azure Monitor Agent Elevation of Privilege Vulnerability
Azure Monitor Agent Elevation of Privilege Vulnerability
-
Medium 4.4
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Microsoft Azure File Sync Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office Remote Code Execution Vulnerability
-
High 7.3
Windows Storage Elevation of Privilege Vulnerability
Windows Storage Elevation of Privilege Vulnerability
-
Medium 5.5
Windows Themes Denial of Service Vulnerability
Windows Themes Denial of Service Vulnerability
-
Medium 6.8
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
Medium 4.4
Cupsd Listen arbitrary chmod 0140777
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to…
-
Medium 6.1
A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow …
-
High 7.8
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…
-
Medium 6.3
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sono…
-
Critical 9.8CVE-2024-3829 Public exploit
Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlin…
-
High 7.8
Avira Prime Link Following Local Privilege Escalation Vulnerability
Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avira Prime. An attacker must first obtain the ability to execute low-privileged code on the tar…
-
High 7.3
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the par…
-
High 7.8
Azure Monitor Agent Elevation of Privilege Vulnerability
Azure Monitor Agent Elevation of Privilege Vulnerability
-
High 7.0
Windows Search Service Elevation of Privilege Vulnerability
Windows Search Service Elevation of Privilege Vulnerability
-
High 7.8
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Arbitrary File Deletion in PaperCut NG/MF Web Print
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and …
-
Medium 6.7
An issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the installation process, …
-
High 7.8CVE-2023-50226 Public exploit
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privil…
-
High 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability…
-
High 7.8
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability t…
-
High 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability…