CWE-59 · Improper Link Resolution Before File Access (page 17)
Page 17 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2007-5200 | | 2007-10-14 | hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the… | |
CVE-2007-5437 | | 2007-10-13 | The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a cra… | |
CVE-2007-5377 | | 2007-10-12 | The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows loca… | |
CVE-2007-5207 | | 2007-10-04 | guilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log.[PID] temporary file. | |
CVE-2007-3916 | | 2007-09-24 | The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary fi… | |
CVE-2007-4652 | | 2007-09-04 | The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink. | |
CVE-2007-4631 | | 2007-08-31 | The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arb… | |
CVE-2007-4224 | | 2007-08-08 | KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. | |
CVE-2007-3742 | | 2007-08-03 | WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) su… | |
CVE-2007-3103 | | 2007-07-15 | The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a s… | |
CVE-2007-2978 | | 2007-06-01 | Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | |
CVE-2007-1027 | | 2007-02-21 | Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIA… | |
CVE-2006-5851 | | 2006-11-10 | openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability tha… | |
CVE-2006-1247 | | 2006-04-19 | rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |
CVE-2005-3126 | | 2005-12-31 | The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a sym… | |
CVE-2005-2714 | | 2005-12-31 | passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on… | |
CVE-2005-2527 | | 2005-12-31 | Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vect… | |
CVE-2005-3349 | | 2005-11-18 | GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file. | |
CVE-2005-3011 | | 2005-09-21 | The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |
CVE-2005-1916 | Medium | 5.5 | 2005-07-06 | linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files. |
CVE-2005-1879 | Medium | 5.5 | 2005-06-09 | LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget. |
CVE-2005-1880 | Medium | 5.5 | 2005-06-06 | everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget. |
CVE-2005-1111 | Medium | 4.7 | 2005-05-02 | Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompres… |
CVE-2005-0824 | Medium | 5.5 | 2005-05-02 | The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arb… |
CVE-2005-0004 | | 2005-04-14 | The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite… | |
CVE-2005-0587 | Medium | 6.5 | 2005-03-25 | Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link… |
CVE-2004-0967 | | 2005-02-09 | The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other o… | |
CVE-2004-2473 | | 2004-12-31 | wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |
CVE-2004-1901 | Medium | 5.5 | 2004-12-31 | Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles. |
CVE-2004-1603 | Medium | 5.5 | 2004-10-18 | cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .h… |
CVE-2004-0689 | High | 7.1 | 2004-09-28 | KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary… |
CVE-2004-0217 | High | 7.0 | 2004-04-15 | The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary f… |
CVE-2003-1528 | | 2003-12-31 | nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file. | |
CVE-2003-1492 | | 2003-12-31 | Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra… | |
CVE-2003-1233 | Critical | 9.8 | 2003-12-31 | Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Wi… |
CVE-2003-0844 | High | 7.1 | 2003-11-17 | mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitr… |
CVE-2003-0578 | High | 7.8 | 2003-08-18 | cci_dir in IBM U2 UniVerse 10.0.0.9 and earlier creates hard links and unlinks files as root, which allows local users to gain privileges by deleting and overw… |
CVE-2003-0517 | Medium | 5.5 | 2003-08-18 | faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files. |
CVE-2002-2382 | | 2002-12-31 | cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out. | |
CVE-2002-2374 | | 2002-12-31 | Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files." | |
CVE-2002-2323 | High | 7.5 | 2002-12-31 | Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored fro… |
CVE-2002-0725 | Medium | 5.5 | 2002-09-05 | NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes t… |
CVE-2002-0824 | | 2002-08-12 | BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device. | |
CVE-2002-0793 | Medium | 5.5 | 2002-08-12 | Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argume… |
CVE-2001-1494 | Medium | 5.5 | 2001-12-31 | script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any… |
CVE-2001-1378 | | 2001-09-06 | fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. | |
CVE-2001-1042 | High | 7.5 | 2001-07-02 | Transsoft Broker 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file. |
CVE-2001-1386 | High | 7.5 | 2001-07-01 | WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD's check for a ".ln… |
CVE-2001-1043 | High | 7.5 | 2001-07-01 | ArGoSoft FTP Server 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file. |
CVE-2001-0131 | | 2001-03-12 | htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. | |
CVE-2000-1178 | Medium | 5.5 | 2001-01-09 | Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of o… |
CVE-2000-0972 | Medium | 5.5 | 2000-12-19 | HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting… |
CVE-2000-0715 | | 2000-10-20 | DiskCheck script diskcheck.pl in Red Hat Linux 6.2 allows local users to create or overwrite arbitrary files via a symlink attack on a temporary file. | |
CVE-2000-0342 | High | 7.5 | 2000-04-28 | Eudora 4.x allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the a… |
CVE-1999-1386 | Medium | 5.5 | 1999-12-31 | Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on… |
CVE-1999-0981 | | 1999-12-08 | Internet Explorer 5.01 and earlier allows a remote attacker to create a reference to a client window and use a server-side redirect to access local files via t… | |
CVE-1999-0794 | | 1999-10-01 | Microsoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file. | |
CVE-1999-0783 | Medium | 5.5 | 1998-06-16 | FreeBSD allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system. |