CWE-59 · Improper Link Resolution Before File Access (page 11)
Page 11 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16896 | High | 7.8 | 2019-12-27 | In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the user, allowing an… |
CVE-2019-19695 | High | 7.5 | 2019-12-24 | A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to create a symbolic link… |
CVE-2019-8463 | High | 7.5 | 2019-12-23 | A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be writt… |
CVE-2019-6679 | Low | 3.3 | 2019-12-23 | On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access control… |
CVE-2019-19693 | High | 7.1 | 2019-12-20 | The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to cr… |
CVE-2019-8789 | Medium | 5.5 | 2019-12-18 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPad… |
CVE-2019-8568 | Medium | 5.5 | 2019-12-18 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 12.3, macOS M… |
CVE-2019-10773 | High | 7.8 | 2019-12-16 | In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" k… |
CVE-2019-16775 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_m… |
CVE-2019-18232 | High | 7.8 | 2019-12-11 | SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. Thi… |
CVE-2019-1483 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker… |
CVE-2013-4184 | Medium | 5.5 | 2019-12-10 | Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks |
CVE-2019-18575 | High | 7.1 | 2019-12-06 | Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability. A locally authenticated malicious user could exploit this vul… |
CVE-2019-7183 | Critical | 9.8 | 2019-12-05 | This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their lat… |
CVE-2019-3690 | Medium | 6.8 | 2019-12-05 | The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenin… |
CVE-2019-3750 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |
CVE-2019-3749 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |
CVE-2011-3632 | High | 7.1 | 2019-11-26 | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. |
CVE-2011-3351 | High | 7.1 | 2019-11-25 | openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enab… |
CVE-2019-17445 | Medium | 5.5 | 2019-11-22 | An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanni… |
CVE-2019-19191 | High | 7.8 | 2019-11-21 | Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd accoun… |
CVE-2014-1938 | Medium | 5.5 | 2019-11-21 | python-rply before 0.7.4 insecurely creates temporary files. |
CVE-2011-2924 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enab… |
CVE-2011-2923 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled… |
CVE-2008-7273 | High | 7.8 | 2019-11-18 | A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling. |
CVE-2011-1136 | Medium | 4.7 | 2019-11-14 | In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. |
CVE-2010-4817 | Medium | 5.5 | 2019-11-13 | pithos before 0.3.5 allows overwrite of arbitrary files via symlinks. |
CVE-2019-18837 | High | 8.6 | 2019-11-13 | An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files out… |
CVE-2013-4655 | High | 7.5 | 2019-11-13 | Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service. |
CVE-2010-3095 | Medium | 4.7 | 2019-11-12 | mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists be… |
CVE-2019-1425 | Medium | 6.5 | 2019-11-12 | An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka 'Visual Studio Elev… |
CVE-2019-1423 | High | 7.8 | 2019-11-12 | An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Windows Elevation of Pr… |
CVE-2019-1422 | High | 7.8 | 2019-11-12 | An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Windows Elevation of… |
CVE-2019-1385 | High | 7.8 | 2019-11-12 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys… |
CVE-2011-3618 | High | 7.8 | 2019-11-12 | atop: symlink attack possible due to insecure tempfile handling |
CVE-2019-18658 | Critical | 9.8 | 2019-11-12 | In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart… |
CVE-2011-5271 | Medium | 5.5 | 2019-11-12 | Pacemaker before 1.1.6 configure script creates temporary files insecurely |
CVE-2009-0035 | Medium | 5.5 | 2019-11-09 | alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh… |
CVE-2013-1809 | High | 7.5 | 2019-11-07 | Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary direc… |
CVE-2013-1429 | Medium | 6.3 | 2019-11-07 | Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. |
CVE-2019-18645 | Medium | 5.5 | 2019-10-31 | The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged di… |
CVE-2010-0398 | Medium | 6.5 | 2019-10-30 | The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack. |
CVE-2010-2064 | High | 7.1 | 2019-10-29 | rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr. |
CVE-2011-1408 | High | 8.2 | 2019-10-29 | ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. |
CVE-2012-2945 | High | 7.5 | 2019-10-29 | Hadoop 1.0.3 contains a symlink vulnerability. |
CVE-2019-18466 | Medium | 5.5 | 2019-10-28 | An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, bec… |
CVE-2019-15627 | High | 7.1 | 2019-10-17 | Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. L… |
CVE-2019-1339 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevati… |
CVE-2019-1317 | High | 7.3 | 2019-10-10 | A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'. |
CVE-2019-1315 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevati… |
CVE-2019-12672 | Medium | 6.8 | 2019-09-25 | A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker with physical access to an affected device to execute a… |
CVE-2019-1280 | High | 7.8 | 2019-09-11 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful… |
CVE-2019-1270 | Medium | 5.5 | 2019-09-11 | An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack, aka 'Microsoft Win… |
CVE-2019-1267 | High | 7.8 | 2019-09-11 | An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vulnerable to symboli… |
CVE-2019-1253 | High | 7.8 | 2019-09-11 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker… |
CVE-2019-11396 | High | 7.8 | 2019-08-29 | An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are inc… |
CVE-2018-20990 | High | 7.5 | 2019-08-26 | An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive. |
CVE-2018-1634 | Medium | 6.7 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbo… |
CVE-2018-1633 | Medium | 6.7 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbo… |
CVE-2018-1632 | Medium | 6.7 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbo… |
CVE-2018-1631 | Medium | 6.7 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbo… |
CVE-2018-1630 | Medium | 6.7 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbo… |
CVE-2019-1188 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfu… |
CVE-2019-5683 | High | 7.8 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the user mode video driver trace logger component. When an attacker has access to… |
CVE-2019-10152 | High | 7.2 | 2019-07-30 | A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has comprom… |
CVE-2019-13382 | High | 7.8 | 2019-07-26 | UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPr… |
CVE-2019-11230 | Medium | 4.4 | 2019-07-18 | In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink… |
CVE-2019-13915 | High | 7.5 | 2019-07-18 | b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it appro… |
CVE-2019-13636 | Medium | 5.9 | 2019-07-17 | In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. |
CVE-2019-1130 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-1129 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-1074 | Medium | 5.5 | 2019-07-15 | An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack… |
CVE-2019-12573 | High | 7.1 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to over… |
CVE-2019-12571 | High | 7.1 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated, local atta… |
CVE-2019-13229 | Medium | 5.5 | 2019-07-04 | deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks… |
CVE-2019-13228 | Medium | 4.7 | 2019-07-04 | deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks there. An unprivilege… |
CVE-2019-13227 | Medium | 5.5 | 2019-07-04 | In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user ca… |
CVE-2019-13226 | High | 7.0 | 2019-07-04 | deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/<block-dev-basename> in the Helper::temporaryMountDevice() function to temporarily m… |
CVE-2019-13173 | High | 7.5 | 2019-07-02 | fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a f… |
CVE-2019-1069 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited… |
CVE-2019-1064 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully explo… |
CVE-2019-1053 | Medium | 6.3 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerabil… |
CVE-2019-0986 | Medium | 6.3 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploi… |
CVE-2019-12749 | High | 7.1 | 2019-06-11 | dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, us… |
CVE-2019-12779 | High | 7.1 | 2019-06-07 | libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) withou… |
CVE-2019-12209 | High | 7.5 | 2019-06-04 | Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not… |
CVE-2019-3567 | High | 8.1 | 2019-06-03 | In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious bina… |
CVE-2019-9949 | High | 8.8 | 2019-05-23 | Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execu… |
CVE-2019-0086 | High | 7.8 | 2019-05-17 | Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Int… |
CVE-2019-0936 | High | 7.8 | 2019-05-16 | An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Pri… |
CVE-2019-5438 | Medium | 5.3 | 2019-05-10 | Path traversal using symlink in npm harp module versions <= 0.29.0. |
CVE-2019-11879 | Medium | 5.5 | 2019-05-10 | The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root direc… |
CVE-2019-1836 | High | 7.1 | 2019-05-03 | A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated… |
CVE-2018-20834 | High | 7.5 | 2019-04-30 | A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball contai… |
CVE-2019-8454 | High | 7.0 | 2019-04-29 | A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file… |
CVE-2019-11538 | High | 7.7 | 2019-04-26 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could… |
CVE-2019-11503 | High | 7.5 | 2019-04-24 | snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling u… |
CVE-2019-11502 | High | 7.5 | 2019-04-24 | snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had… |
CVE-2019-8452 | High | 7.8 | 2019-04-22 | A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file… |
CVE-2019-3902 | Medium | 5.1 | 2019-04-22 | A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside… |