CWE-59 · Improper Link Resolution Before File Access (page 7)
Page 7 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46654 | High | 8.1 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBe… |
CVE-2023-28797 | Medium | 6.3 | 2023-10-23 | Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folde… |
CVE-2023-36737 | High | 7.8 | 2023-10-10 | Azure Network Watcher VM Agent Elevation of Privilege Vulnerability |
CVE-2023-36723 | High | 7.8 | 2023-10-10 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2023-36711 | High | 7.8 | 2023-10-10 | Windows Runtime C++ Template Library Elevation of Privilege Vulnerability |
CVE-2023-36568 | High | 7.0 | 2023-10-10 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
CVE-2023-45159 | High | 8.4 | 2023-10-05 | 1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point… |
CVE-2023-41968 | Medium | 5.5 | 2023-09-27 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and… |
CVE-2023-32182 | Medium | 5.9 | 2023-09-19 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise… |
CVE-2023-36758 | High | 7.8 | 2023-09-12 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-4759 | High | 8.8 | 2023-09-12 | Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git re… |
CVE-2023-32163 | High | 7.8 | 2023-09-06 | Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2022-46869 | High | 7.8 | 2023-08-31 | Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Wind… |
CVE-2023-34723 | High | 7.5 | 2023-08-25 | An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf. |
CVE-2019-13689 | High | 7.8 | 2023-08-25 | Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/write via a malicious… |
CVE-2023-40028 | Medium | 4.9 | 2023-08-15 | Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files tha… |
CVE-2023-38175 | High | 7.8 | 2023-08-08 | Microsoft Windows Defender Elevation of Privilege Vulnerability |
CVE-2023-36903 | High | 7.8 | 2023-08-08 | Windows System Assessment Tool Elevation of Privilege Vulnerability |
CVE-2023-36876 | High | 7.1 | 2023-08-08 | Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability |
CVE-2023-35379 | High | 7.8 | 2023-08-08 | Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability |
CVE-2022-48579 | High | 7.5 | 2023-08-07 | UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains. |
CVE-2023-39107 | Critical | 9.1 | 2023-08-04 | An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned file… |
CVE-2023-4053 | Medium | 6.5 | 2023-08-01 | A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have l… |
CVE-2023-4052 | Medium | 6.5 | 2023-08-01 | The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted w… |
CVE-2023-36874 | High | 7.8 | 2023-07-11 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2023-35353 | High | 7.8 | 2023-07-11 | Connected User Experiences and Telemetry Elevation of Privilege Vulnerability |
CVE-2023-35347 | High | 7.1 | 2023-07-11 | Microsoft Install Service Elevation of Privilege Vulnerability |
CVE-2023-35342 | High | 7.8 | 2023-07-11 | Windows Image Acquisition Elevation of Privilege Vulnerability |
CVE-2023-35320 | High | 7.8 | 2023-07-11 | Connected User Experiences and Telemetry Elevation of Privilege Vulnerability |
CVE-2023-33148 | High | 7.8 | 2023-07-11 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2023-32056 | High | 7.8 | 2023-07-11 | Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability |
CVE-2023-32053 | High | 7.8 | 2023-07-11 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-32050 | High | 7.0 | 2023-07-11 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-37206 | Medium | 6.5 | 2023-07-05 | Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability a… |
CVE-2023-27469 | High | 7.1 | 2023-06-30 | Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\0' c… |
CVE-2023-32556 | Medium | 5.5 | 2023-06-26 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information. P… |
CVE-2023-28065 | Medium | 6.7 | 2023-06-23 | Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerabilit… |
CVE-2023-28071 | Medium | 6.3 | 2023-06-23 | Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnera… |
CVE-2023-32012 | High | 7.8 | 2023-06-14 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2023-29351 | High | 8.1 | 2023-06-14 | Windows Group Policy Elevation of Privilege Vulnerability |
CVE-2023-33865 | High | 7.8 | 2023-06-07 | RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership. |
CVE-2023-2939 | High | 7.8 | 2023-05-30 | Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via craft… |
CVE-2023-33245 | High | 8.8 | 2023-05-30 | Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains… |
CVE-2023-34204 | Medium | 6.5 | 2023-05-30 | imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (f… |
CVE-2023-27529 | High | 7.8 | 2023-05-25 | Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a user is tricked to exe… |
CVE-2023-29343 | High | 7.8 | 2023-05-09 | SysInternals Sysmon for Windows Elevation of Privilege Vulnerability |
CVE-2023-24904 | High | 7.1 | 2023-05-09 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-38730 | Medium | 6.3 | 2023-04-27 | Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-ro… |
CVE-2022-34292 | High | 7.1 | 2023-04-27 | Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling… |
CVE-2022-31647 | High | 7.1 | 2023-04-27 | Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder param… |
CVE-2023-28141 | Medium | 6.7 | 2023-04-18 | An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations… |
CVE-2023-28972 | Medium | 6.8 | 2023-04-17 | An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass con… |
CVE-2023-28222 | High | 7.1 | 2023-04-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-43293 | Medium | 5.9 | 2023-04-11 | Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wacom\Wacom_Tablet.exe. |
CVE-2022-38604 | High | 7.3 | 2023-04-11 | Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability. |
CVE-2023-0652 | High | 7.0 | 2023-04-06 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0… |
CVE-2023-1412 | High | 7.0 | 2023-04-05 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform p… |
CVE-2023-25940 | Medium | 6.7 | 2023-04-04 | Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A high privileged local attacker… |
CVE-2022-47188 | High | 7.5 | 2023-03-31 | There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a ba… |
CVE-2023-28642 | Medium | 6.1 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the c… |
CVE-2023-28892 | High | 7.8 | 2023-03-29 | Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the targ… |
CVE-2023-26088 | High | 7.8 | 2023-03-23 | In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system. It can also lead… |
CVE-2023-1314 | High | 7.5 | 2023-03-21 | A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative pe… |
CVE-2023-24930 | High | 7.8 | 2023-03-14 | Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability |
CVE-2023-24577 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a use… |
CVE-2023-25148 | High | 7.8 | 2023-03-10 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file int… |
CVE-2023-25146 | High | 7.8 | 2023-03-10 | A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder a… |
CVE-2023-25145 | High | 7.8 | 2023-03-10 | A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installat… |
CVE-2023-27850 | Medium | 6.8 | 2023-03-10 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on… |
CVE-2022-22582 | Medium | 5.5 | 2023-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2… |
CVE-2022-45697 | High | 7.8 | 2023-02-27 | Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory. |
CVE-2023-23558 | Medium | 6.3 | 2023-02-16 | In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 befo… |
CVE-2023-21567 | Medium | 5.6 | 2023-02-14 | Visual Studio Denial of Service Vulnerability |
CVE-2023-22490 | Medium | 5.5 | 2023-02-14 | Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2… |
CVE-2023-21722 | Medium | 5.0 | 2023-02-14 | .NET Framework Denial of Service Vulnerability |
CVE-2023-24572 | Medium | 4.7 | 2023-02-13 | Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation. A locally au… |
CVE-2023-23697 | Medium | 4.7 | 2023-02-13 | Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated m… |
CVE-2022-42292 | Medium | 5.0 | 2023-02-12 | NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a… |
CVE-2023-25168 | Critical | 9.6 | 2023-02-09 | Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability… |
CVE-2023-25152 | High | 8.4 | 2023-02-08 | Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on… |
CVE-2022-42291 | High | 8.2 | 2023-02-07 | NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete d… |
CVE-2020-36657 | High | 7.8 | 2023-01-26 | uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard link within the /var/… |
CVE-2023-20008 | Medium | 4.4 | 2023-01-20 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local… |
CVE-2022-45440 | Medium | 4.4 | 2023-01-17 | A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A… |
CVE-2022-3592 | Medium | 6.5 | 2023-01-12 | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw… |
CVE-2023-21760 | High | 7.1 | 2023-01-10 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2023-21725 | Medium | 6.3 | 2023-01-10 | Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability |
CVE-2023-21678 | High | 7.8 | 2023-01-10 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2023-21542 | High | 7.0 | 2023-01-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-38482 | Medium | 4.3 | 2023-01-10 | A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4. |
CVE-2022-36943 | High | 8.1 | 2023-01-03 | SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will… |
CVE-2021-4287 | Medium | 5.0 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/mod… |
CVE-2022-45798 | High | 7.8 | 2022-12-24 | A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacke… |
CVE-2022-45412 | High | 8.8 | 2022-12-22 | When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing un… |
CVE-2022-4563 | High | 7.8 | 2022-12-16 | A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file g… |
CVE-2022-4122 | Medium | 5.3 | 2022-12-08 | A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure. |
CVE-2009-1143 | High | 7.0 | 2022-11-23 | An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that le… |
CVE-2009-1142 | Medium | 6.7 | 2022-11-23 | An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is s… |
CVE-2022-44747 | High | 7.8 | 2022-11-07 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-32905 | High | 7.8 | 2022-11-01 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to a… |