CWE-59 · Improper Link Resolution Before File Access (page 10)
Page 10 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27697 | High | 7.8 | 2020-11-18 | Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected lo… |
CVE-2020-23968 | High | 7.8 | 2020-11-10 | Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\000-sngWSService1.lo… |
CVE-2020-5795 | Medium | 6.2 | 2020-11-06 | UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execu… |
CVE-2020-6015 | Medium | 5.5 | 2020-11-05 | Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of servic… |
CVE-2020-16007 | High | 7.8 | 2020-11-03 | Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2018-21269 | Medium | 5.5 | 2020-10-27 | checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink. |
CVE-2017-18925 | Medium | 5.5 | 2020-10-26 | opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack. |
CVE-2020-9901 | High | 7.8 | 2020-10-22 | An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and i… |
CVE-2020-9900 | High | 7.8 | 2020-10-22 | An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and i… |
CVE-2020-16939 | High | 7.8 | 2020-10-16 | <p>An elevation of privilege vulnerability exists when Group Policy improperly checks access. An attacker who successfully exploited this vulnerability could r… |
CVE-2020-25776 | High | 7.8 | 2020-10-02 | Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on t… |
CVE-2020-24562 | High | 7.8 | 2020-09-29 | A vulnerability in Trend Micro OfficeScan XG SP1 on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could b… |
CVE-2020-17365 | High | 7.8 | 2020-09-24 | Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable esca… |
CVE-2020-6546 | High | 7.8 | 2020-09-21 | Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-25744 | High | 8.1 | 2020-09-18 | SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files, which could cause a denial of service (DoS) conditi… |
CVE-2020-25289 | Medium | 5.5 | 2020-09-13 | The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directo… |
CVE-2020-16853 | High | 7.1 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successf… |
CVE-2020-16851 | High | 7.1 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successf… |
CVE-2014-1420 | Low | 3.8 | 2020-09-11 | On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver woul… |
CVE-2020-7325 | Medium | 5.5 | 2020-09-09 | Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to access files which the user otherwise would not have a… |
CVE-2020-7319 | High | 8.8 | 2020-09-09 | Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to access files wh… |
CVE-2020-24654 | Low | 3.3 | 2020-09-02 | In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a us… |
CVE-2020-24955 | High | 7.8 | 2020-09-01 | SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from… |
CVE-2020-24559 | High | 7.8 | 2020-09-01 | A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to mani… |
CVE-2020-24556 | High | 7.8 | 2020-09-01 | A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows… |
CVE-2020-25031 | High | 7.8 | 2020-08-31 | checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file. |
CVE-2020-14367 | Medium | 6.0 | 2020-08-24 | A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while… |
CVE-2020-15861 | High | 7.8 | 2020-08-20 | Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. |
CVE-2019-20383 | High | 7.8 | 2020-08-13 | ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations invol… |
CVE-2020-24332 | Medium | 5.5 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlin… |
CVE-2020-6012 | High | 7.4 | 2020-08-04 | ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace t… |
CVE-2020-11474 | High | 7.8 | 2020-07-28 | NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant. |
CVE-2020-15932 | High | 8.8 | 2020-07-24 | Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. |
CVE-2020-9682 | Critical | 9.8 | 2020-07-17 | Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary f… |
CVE-2020-9670 | Critical | 9.8 | 2020-07-17 | Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege e… |
CVE-2020-3437 | Medium | 6.5 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on… |
CVE-2020-7282 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access… |
CVE-2020-13095 | High | 8.8 | 2020-06-30 | Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the pa… |
CVE-2020-15401 | Medium | 4.4 | 2020-06-30 | IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junct… |
CVE-2020-14990 | High | 7.1 | 2020-06-22 | IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the Clean & Optimize feature with an NTFS jun… |
CVE-2020-14004 | High | 7.8 | 2020-06-12 | An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cm… |
CVE-2020-2026 | High | 7.8 | 2020-06-10 | A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into… |
CVE-2020-8103 | High | 7.2 | 2020-06-05 | A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and r… |
CVE-2020-13833 | Critical | 9.1 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink att… |
CVE-2020-3237 | Medium | 6.3 | 2020-06-03 | A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite… |
CVE-2020-3223 | Medium | 4.9 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges… |
CVE-2020-7653 | Medium | 6.5 | 2020-05-29 | All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal networ… |
CVE-2020-6477 | High | 7.8 | 2020-05-21 | Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted… |
CVE-2020-2024 | Medium | 6.5 | 2020-05-19 | An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runti… |
CVE-2020-5837 | High | 7.8 | 2020-05-11 | Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to… |
CVE-2020-11443 | High | 8.1 | 2020-05-04 | The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version… |
CVE-2020-11446 | High | 7.8 | 2020-04-29 | ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then… |
CVE-2020-12265 | Critical | 9.8 | 2020-04-26 | The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Director… |
CVE-2020-12254 | High | 7.8 | 2020-04-26 | Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. |
CVE-2020-8831 | Medium | 6.5 | 2020-04-22 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this i… |
CVE-2020-8099 | High | 7.1 | 2020-04-21 | A vulnerability in the improper handling of junctions in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restor… |
CVE-2020-10947 | High | 8.8 | 2020-04-17 | Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. |
CVE-2020-8948 | High | 7.8 | 2020-04-15 | The Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an unprivileged user to overwrite arbitrary files in arbitrary fol… |
CVE-2020-7250 | High | 8.2 | 2020-04-15 | Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to… |
CVE-2020-5738 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted ta… |
CVE-2020-11736 | Low | 3.9 | 2020-04-13 | fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is… |
CVE-2020-1885 | High | 7.8 | 2020-04-08 | Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrar… |
CVE-2020-8015 | High | 8.4 | 2020-04-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root… |
CVE-2020-10665 | Medium | 6.7 | 2020-03-18 | Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, lead… |
CVE-2020-0789 | High | 7.1 | 2020-03-12 | A denial of service vulnerability exists when the Visual Studio Extension Installer Service improperly handles hard links, aka 'Visual Studio Extension Install… |
CVE-2020-0787 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows… |
CVE-2020-0779 | Medium | 5.5 | 2020-03-12 | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege… |
CVE-2020-10174 | High | 7.0 | 2020-03-05 | init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It f… |
CVE-2020-8013 | Low | 2.2 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Se… |
CVE-2019-18901 | Medium | 5.1 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Ente… |
CVE-2019-18897 | High | 8.4 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE F… |
CVE-2019-3698 | Medium | 5.7 | 2020-02-28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; op… |
CVE-2020-3835 | Medium | 4.4 | 2020-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2020-3830 | Low | 3.3 | 2020-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2012-1093 | High | 7.8 | 2020-02-21 | The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package insta… |
CVE-2020-5324 | High | 7.1 | 2020-02-21 | Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utili… |
CVE-2020-8950 | High | 7.8 | 2020-02-12 | The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %… |
CVE-2020-0730 | High | 7.1 | 2020-02-11 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service E… |
CVE-2020-0683 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege… |
CVE-2019-11481 | Low | 3.8 | 2020-02-08 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a us… |
CVE-2020-7221 | High | 7.8 | 2020-02-04 | mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafe… |
CVE-2019-11251 | Medium | 4.8 | 2020-02-03 | The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar… |
CVE-2011-4116 | Low | 3.3 | 2020-01-31 | _is_safe in the File::Temp module for Perl does not properly handle symlinks. |
CVE-2020-8095 | Medium | 4.9 | 2020-01-30 | A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of servic… |
CVE-2013-1867 | Medium | 6.1 | 2020-01-30 | Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability |
CVE-2013-1866 | Medium | 6.1 | 2020-01-30 | OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability |
CVE-2012-6114 | Medium | 5.5 | 2020-01-28 | The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effor… |
CVE-2019-3699 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user pr… |
CVE-2019-3697 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to… |
CVE-2019-3694 | High | 7.7 | 2020-01-24 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin t… |
CVE-2019-3693 | High | 7.7 | 2020-01-24 | A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed l… |
CVE-2019-3692 | High | 7.7 | 2020-01-24 | The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attac… |
CVE-2019-3691 | High | 7.7 | 2020-01-23 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to esc… |
CVE-2019-18898 | High | 7.7 | 2020-01-23 | UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers e… |
CVE-2020-7040 | High | 8.1 | 2020-01-21 | storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation… |
CVE-2019-18932 | High | 7.0 | 2020-01-21 | log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As… |
CVE-2020-0638 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first… |
CVE-2020-0616 | Medium | 5.5 | 2020-01-14 | A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'. |
CVE-2015-3147 | Medium | 6.5 | 2020-01-14 | daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to ar… |
CVE-2015-1869 | High | 7.8 | 2020-01-14 | The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log… |