CWE-61 · UNIX Symbolic Link (Symlink) Following (page 2)
Page 2 of 2 — CVEs classified under CWE-61, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52535 | High | 7.1 | 2024-12-25 | Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) at… |
CVE-2024-47515 | High | 8.1 | 2024-12-24 | A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allo… |
CVE-2024-54148 | Critical | 9.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the se… |
CVE-2024-47480 | High | 7.8 | 2024-12-18 | Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with… |
CVE-2024-52542 | Medium | 4.4 | 2024-12-17 | Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit… |
CVE-2024-52537 | Medium | 6.3 | 2024-12-11 | Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially… |
CVE-2024-54661 | Critical | 9.8 | 2024-12-04 | readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file. |
CVE-2024-52522 | | 2024-11-15 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --… | |
CVE-2023-20093 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20092 | Medium | 4.4 | 2024-11-15 | Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local fil… |
CVE-2023-20091 | Medium | 5.1 | 2024-11-15 | A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file syst… |
CVE-2024-34015 | Low | 3.3 | 2024-11-11 | Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cP… |
CVE-2024-34014 | Medium | 5.5 | 2024-11-11 | Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (L… |
CVE-2024-0134 | Medium | 4.1 | 2024-11-05 | NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of u… |
CVE-2024-47877 | High | 7.5 | 2024-10-11 | Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside… |
CVE-2024-44132 | High | 8.8 | 2024-09-17 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
CVE-2024-45310 | Low | 3.6 | 2024-09-03 | runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tr… |
CVE-2024-39578 | Medium | 6.3 | 2024-08-31 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-42367 | Medium | 4.8 | 2024-08-12 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which con… |
CVE-2024-27872 | Medium | 5.5 | 2024-07-29 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data. |
CVE-2024-28189 | Critical | 10.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abu… |
CVE-2024-28185 | Critical | 10.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leverage… |
CVE-2024-22014 | High | 8.8 | 2024-04-15 | An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to A… |
CVE-2024-25953 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-25952 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2023-41969 | High | 7.3 | 2024-03-26 | An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modi… |
CVE-2024-1933 | High | 7.1 | 2024-03-26 | Insecure UNIX Symbolic Link (Symlink) Following in TeamViewer Remote Client prior Version 15.52 for macOS allows an attacker with unprivileged access, to poten… |
CVE-2024-23285 | Medium | 5.5 | 2024-03-08 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regio… |
CVE-2023-39246 | Medium | 4.6 | 2023-11-16 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows… |
CVE-2023-37460 | High | 8.1 | 2023-07-25 | Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to… |
CVE-2022-3592 | Medium | 6.5 | 2023-01-12 | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw… |
CVE-2021-4287 | Medium | 5.0 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/mod… |
CVE-2022-31036 | Medium | 4.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bu… |
CVE-2022-24904 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is… |
CVE-2021-1612 | Medium | 5.5 | 2021-09-23 | A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vul… |
CVE-2021-39135 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guar… |
CVE-2021-39134 | High | 8.2 | 2021-08-31 | `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to gu… |
CVE-2021-32518 | High | 7.5 | 2021-07-07 | A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The referred vulnerability… |
CVE-2021-32509 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symb… |
CVE-2021-32508 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Sy… |
CVE-2021-25321 | High | 7.8 | 2021-06-30 | A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud C… |
CVE-2021-32557 | Medium | 5.2 | 2021-06-12 | It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. |
CVE-2021-32555 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package a… |
CVE-2021-32554 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hook… |
CVE-2021-32553 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package appor… |
CVE-2021-32552 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package appor… |
CVE-2021-32551 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package appor… |
CVE-2021-32550 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package appor… |
CVE-2021-32549 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package appor… |
CVE-2021-32548 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport… |
CVE-2021-32547 | High | 7.3 | 2021-06-12 | It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package appo… |
CVE-2021-25322 | Medium | 6.8 | 2021-06-10 | A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from t… |
CVE-2020-15076 | High | 7.8 | 2021-05-26 | Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp. |
CVE-2020-15075 | High | 7.1 | 2021-03-30 | OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. |
CVE-2021-1145 | Medium | 6.5 | 2021-01-13 | A vulnerability in the Secure FTP (SFTP) of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an authenticated, remote attacker to read arbitrary file… |
CVE-2020-8019 | High | 7.7 | 2020-06-29 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo… |
CVE-2020-8014 | High | 7.7 | 2020-06-29 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with… |
CVE-2019-11251 | Medium | 4.8 | 2020-02-03 | The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar… |
CVE-2019-16775 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_m… |
CVE-2019-11249 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2019-11246 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2017-14798 | High | 7.3 | 2018-03-01 | A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root. |