CWE-59: Improper Link Resolution Before File Access (Link Following), page 14

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

1. 7.0CVE-2024-49059EPSS 0.4%2024-12-12

   Microsoft Office Elevation of Privilege Vulnerability

2. 6.7CVE-2024-52537EPSS 0.2%2024-12-11

   Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

3. 9.8CVE-2024-37143EPSS 0.8%2024-12-10

   Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Ma…

4. 8.7CVE-2024-53691EPSS 24%2024-12-06

   A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations…

5. 6.8CVE-2024-50404EPSS 1.4%2024-12-06

   A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed …

6. 6.8CVE-2024-22038EPSS 0.2%2024-11-28

   Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service.

7. 7.8CVE-2024-7243EPSS 0.3%2024-11-22

   Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to ex…

8. 7.8CVE-2024-7242EPSS 0.3%2024-11-22

   Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to ex…

9. 7.8CVE-2024-7241EPSS 0.3%2024-11-22

   Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to ex…

10. 7.8CVE-2024-7240EPSS 0.4%2024-11-22

    F-Secure Total Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of F-Secure Total. User interaction on the part of an administrator is requi…

11. 7.8CVE-2024-7239EPSS 0.4%2024-11-22

    VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the abili…

12. 7.8CVE-2024-7238EPSS 0.4%2024-11-22

    VIPRE Advanced Security SBAMSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain t…

13. 7.8CVE-2024-7237EPSS 0.3%2024-11-22

    AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability …

14. 5.5CVE-2024-7236EPSS 0.3%2024-11-22

    AVG AntiVirus Free icarus Arbitrary File Creation Denial of Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AVG AntiVirus Free. An attacker must first ob…

15. 5.5CVE-2024-7235EPSS 0.3%2024-11-22

    AVG AntiVirus Free Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability…

16. 7.8CVE-2024-7234EPSS 0.4%2024-11-22

    AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability …

17. 7.8CVE-2024-7233EPSS 0.4%2024-11-22

    Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ab…

18. 7.8CVE-2024-7232EPSS 0.4%2024-11-22

    Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ab…

19. 7.8CVE-2024-7231EPSS 0.3%2024-11-22

    Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability t…

20. 7.8CVE-2024-7230EPSS 0.3%2024-11-22

    Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability t…

21. 7.8CVE-2024-7229EPSS 0.3%2024-11-22

    Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability t…

22. 5.5CVE-2024-7228EPSS 0.3%2024-11-22

    Avast Free Antivirus Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Avast Free Antivirus. An attacker must first obtain the abi…

23. 7.8CVE-2024-7227EPSS 0.4%2024-11-22

    Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ab…

24. 7.8CVE-2024-9766EPSS 0.3%2024-11-22

    Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Center. An attacker must first obtain the ability t…

25. 7.8CVE-2024-6260EPSS 0.3%2024-11-22

    Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the abi…

26. 7.8CVE-2024-6233EPSS 0.4%2024-11-22

    Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attack…

27. 7.8CVE-2024-30377EPSS 0.4%2024-11-22

    G DATA Total Security Scan Server Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain t…

28. 7.8CVE-2024-1868EPSS 0.4%2024-11-22

    G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability t…

29. 7.8CVE-2024-1867EPSS 0.4%2024-11-22

    G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability t…

30. 8.7CVE-2024-48862EPSS 0.9%2024-11-22

    A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected file…

31. 5.4CVE-2024-52522EPSS 0.2%2024-11-15

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indi…

32. 6.5CVE-2021-1491EPSS 1.3%2024-11-15

    A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to in…

33. 4.4CVE-2023-20004EPSS 0.2%2024-11-15

    Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper acc…

34. 7.3CVE-2024-51721EPSS 0.2%2024-11-12

    A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would…

35. 7.8CVE-2024-49051EPSS 0.6%2024-11-12

    Microsoft PC Manager Elevation of Privilege Vulnerability

36. 8.7CVE-2024-10007EPSS 0.8%2024-11-07

    A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administ…

37. 9.8CVE-2024-6868EPSS 1.5%2024-10-29

    mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted…

38. 5.5CVE-2024-44273EPSS 0.3%2024-10-28

    This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A malicious app may be able to access private inf…

39. 5.5CVE-2024-44264EPSS 0.6%2024-10-28

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app may be able to create symlinks to protected regions of the disk.

40. 7.1CVE-2024-44258EPSS 0.8%2024-10-28

    This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, tvOS 18.1, visionOS 2.1. Restoring a maliciously crafted backup file may lead to modification of pr…

41. 5.5CVE-2024-44175EPSS 0.6%2024-10-28

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.

42. 7.8CVE-2024-45316EPSS 0.3%2024-10-11

    The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, po…

43. 5.5CVE-2024-45315EPSS 0.2%2024-10-11

    The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, po…

44. 5.5CVE-2024-43603EPSS 0.8%2024-10-08

    Visual Studio Collector Service Denial of Service Vulnerability

45. 7.8CVE-2024-43551EPSS 0.6%2024-10-08

    Windows Storage Elevation of Privilege Vulnerability

46. 7.8CVE-2024-43501EPSS 0.7%2024-10-08

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

47. 7.1CVE-2024-38097EPSS 0.6%2024-10-08

    Azure Monitor Agent Elevation of Privilege Vulnerability

48. 8.8CVE-2024-27458EPSS 0.2%2024-10-07

    A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are …

49. 8.2CVE-2024-9341EPSS 1.0%2024-10-01

    A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic li…

50. 7.8CVE-2024-8404EPSS 0.4%2024-09-26

    An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting…