CWE-59 · Improper Link Resolution Before File Access (page 8)
Page 8 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41973 | High | 7.8 | 2022-10-29 | multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to… |
CVE-2022-31256 | High | 7.7 | 2022-10-26 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows lo… |
CVE-2022-39253 | Medium | 5.5 | 2022-10-19 | Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are… |
CVE-2022-42725 | High | 7.5 | 2022-10-10 | Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links. |
CVE-2022-40710 | High | 7.8 | 2022-09-28 | A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate pri… |
CVE-2022-38699 | Medium | 5.9 | 2022-09-28 | Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privile… |
CVE-2022-40143 | High | 7.3 | 2022-09-19 | A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to… |
CVE-2022-34893 | High | 7.8 | 2022-09-19 | Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead… |
CVE-2022-39215 | High | 8.3 | 2022-09-15 | Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possib… |
CVE-2022-36113 | Medium | 4.6 | 2022-09-14 | Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, mak… |
CVE-2022-0029 | Medium | 5.5 | 2022-09-14 | An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system wit… |
CVE-2022-26456 | Medium | 4.4 | 2022-09-06 | In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution priv… |
CVE-2022-2898 | Medium | 6.1 | 2022-08-31 | Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition. |
CVE-2022-2897 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation.. |
CVE-2021-35939 | Medium | 6.7 | 2022-08-26 | It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created… |
CVE-2021-35938 | Medium | 6.7 | 2022-08-25 | A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user coul… |
CVE-2021-35937 | Medium | 6.4 | 2022-08-25 | A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-201… |
CVE-2022-34960 | Critical | 9.8 | 2022-08-25 | The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hos… |
CVE-2021-31566 | High | 7.8 | 2022-08-23 | An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of t… |
CVE-2021-23177 | High | 7.8 | 2022-08-23 | An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may prov… |
CVE-2022-36336 | High | 7.8 | 2022-07-30 | A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalat… |
CVE-2022-35631 | Medium | 5.5 | 2022-07-29 | On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velocira… |
CVE-2022-31250 | High | 7.1 | 2022-07-20 | A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This… |
CVE-2022-32450 | High | 7.1 | 2022-07-18 | AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and… |
CVE-2022-21770 | Medium | 6.7 | 2022-07-06 | In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution pri… |
CVE-2022-2145 | Medium | 5.8 | 2022-06-28 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client… |
CVE-2022-31036 | Medium | 4.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bu… |
CVE-2021-42056 | Medium | 6.7 | 2022-06-24 | Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, throug… |
CVE-2022-34008 | High | 7.8 | 2022-06-21 | Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory… |
CVE-2022-25856 | High | 7.5 | 2022-06-17 | The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in gi… |
CVE-2022-28225 | High | 7.8 | 2022-06-15 | Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2021-25261 | High | 7.8 | 2022-06-15 | Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2022-31219 | High | 7.3 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31218 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31217 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31216 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2021-41641 | High | 8.4 | 2022-06-12 | Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain… |
CVE-2022-30687 | High | 7.1 | 2022-05-27 | Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secu… |
CVE-2022-26704 | High | 7.8 | 2022-05-26 | A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An a… |
CVE-2022-26688 | Medium | 4.4 | 2022-05-26 | An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, mac… |
CVE-2022-30321 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 an… |
CVE-2022-31466 | High | 7.9 | 2022-05-23 | Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, pot… |
CVE-2022-31258 | High | 8.2 | 2022-05-20 | In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink. |
CVE-2022-24904 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is… |
CVE-2022-30523 | High | 7.8 | 2022-05-16 | Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a lo… |
CVE-2022-23742 | High | 7.8 | 2022-05-12 | Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacke… |
CVE-2022-30333 | High | 7.5 | 2022-05-09 | RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a… |
CVE-2021-44052 | Medium | 6.5 | 2022-05-05 | An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS… |
CVE-2022-20103 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution… |
CVE-2022-20085 | Medium | 6.7 | 2022-05-03 | In netdiag, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execut… |
CVE-2022-24372 | Medium | 4.6 | 2022-04-27 | Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share. |
CVE-2022-20720 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-1256 | High | 7.8 | 2022-04-14 | A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the re… |
CVE-2022-22962 | High | 7.8 | 2022-04-11 | VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vu… |
CVE-2022-20068 | Medium | 6.7 | 2022-04-11 | In mobile_log_d, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System e… |
CVE-2022-27883 | High | 7.3 | 2022-04-09 | A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to p… |
CVE-2022-26612 | Critical | 9.8 | 2022-04-07 | In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may… |
CVE-2021-27117 | High | 7.8 | 2022-04-05 | An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally. |
CVE-2021-27116 | High | 7.8 | 2022-04-05 | An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. |
CVE-2022-0799 | High | 8.8 | 2022-04-05 | Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation… |
CVE-2022-27816 | High | 7.1 | 2022-03-30 | SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. |
CVE-2022-27815 | High | 7.8 | 2022-03-30 | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service. |
CVE-2022-22995 | Critical | 10.0 | 2022-03-25 | The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of p… |
CVE-2022-26659 | High | 7.1 | 2022-03-25 | Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of… |
CVE-2022-22585 | High | 7.5 | 2022-03-18 | An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and i… |
CVE-2022-20050 | Medium | 6.7 | 2022-03-10 | In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System exe… |
CVE-2022-22262 | High | 7.7 | 2022-03-01 | ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this functi… |
CVE-2022-24680 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24679 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24671 | High | 7.8 | 2022-02-24 | A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during t… |
CVE-2021-44141 | Medium | 4.3 | 2022-02-21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the… |
CVE-2021-44730 | High | 7.8 | 2022-02-17 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap… |
CVE-2022-25179 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM… |
CVE-2022-25177 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library whe… |
CVE-2022-25176 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM whe… |
CVE-2022-0017 | High | 7.0 | 2022-02-10 | An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a lo… |
CVE-2022-21999 | High | 7.8 | 2022-02-09 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-21997 | High | 7.1 | 2022-02-09 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2021-23521 | Medium | 5.5 | 2022-01-31 | This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbo… |
CVE-2022-21944 | High | 7.8 | 2022-01-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attacker… |
CVE-2021-41551 | Medium | 4.9 | 2022-01-18 | Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link. |
CVE-2022-0012 | Medium | 6.1 | 2022-01-12 | An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user t… |
CVE-2022-21919 | High | 7.0 | 2022-01-11 | Windows User Profile Service Elevation of Privilege Vulnerability |
CVE-2022-21895 | High | 7.8 | 2022-01-11 | Windows User Profile Service Elevation of Privilege Vulnerability |
CVE-2022-21838 | Medium | 5.5 | 2022-01-11 | Windows Cleanup Manager Elevation of Privilege Vulnerability |
CVE-2021-45442 | High | 7.1 | 2022-01-10 | A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary… |
CVE-2021-45231 | High | 7.8 | 2022-01-10 | A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Servi… |
CVE-2021-44024 | High | 7.1 | 2022-01-10 | A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services… |
CVE-2021-20153 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulner… |
CVE-2021-23772 | High | 7.5 | 2021-12-24 | This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upl… |
CVE-2021-44023 | High | 7.1 | 2021-12-16 | A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC… |
CVE-2021-43238 | High | 7.8 | 2021-12-15 | Windows Remote Access Elevation of Privilege Vulnerability |
CVE-2021-43237 | High | 7.8 | 2021-12-15 | Windows Setup Elevation of Privilege Vulnerability |
CVE-2021-42297 | Medium | 5.0 | 2021-11-24 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-44038 | High | 7.8 | 2021-11-19 | An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned direc… |
CVE-2021-41057 | High | 7.1 | 2021-11-14 | In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. |
CVE-2021-41379 | Medium | 5.5 | 2021-11-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2021-3641 | Medium | 6.1 | 2021-11-09 | Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a… |
CVE-2021-21695 | High | 8.8 | 2021-11-04 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 an… |
CVE-2021-21691 | Critical | 9.8 | 2021-11-04 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |