CWE-59: Improper Link Resolution Before File Access (Link Following), page 15

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

1. 4.4CVE-2024-45770EPSS 0.3%2024-09-19

   A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. U…

2. 7.8CVE-2024-46744EPSS 0.3%2024-09-18

   In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately cause…

3. 5.5CVE-2024-44178EPSS 0.3%2024-09-17

   This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system.

4. 8.8CVE-2024-44132EPSS 0.2%2024-09-17

   This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.

5. 5.5CVE-2024-44131EPSS 0.7%2024-09-17

   This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data.

6. 7.3CVE-2024-43470EPSS 0.9%2024-09-10

   Azure Network Watcher VM Agent Elevation of Privilege Vulnerability

7. 7.1CVE-2024-38188EPSS 0.6%2024-09-10

   Azure Network Watcher VM Agent Elevation of Privilege Vulnerability

8. 6.3CVE-2024-39578EPSS 0.2%2024-08-31

   Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, informatio…

9. 7.3CVE-2023-43078EPSS 0.2%2024-08-28

   Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service.

10. 7.8CVE-2024-5928EPSS 0.4%2024-08-21

    VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain t…

11. 7.8CVE-2024-38098EPSS 0.6%2024-08-13

    Azure Connected Machine Agent Elevation of Privilege Vulnerability

12. 7.8CVE-2024-38084EPSS 0.7%2024-08-13

    Microsoft OfficePlus Elevation of Privilege Vulnerability

13. 7.8CVE-2024-7252EPSS 0.3%2024-07-29

    Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must fir…

14. 7.8CVE-2024-7251EPSS 0.3%2024-07-29

    Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must fir…

15. 7.8CVE-2024-7250EPSS 0.3%2024-07-29

    Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must fir…

16. 7.8CVE-2024-7249EPSS 0.3%2024-07-29

    Comodo Firewall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Firewall. An attacker must first obtain the ability to execute lo…

17. 7.3CVE-2024-29069EPSS 0.2%2024-07-25

    In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file…

18. 7.3CVE-2024-38081EPSS 1.3%2024-07-09

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

19. 7.0CVE-2024-38022EPSS 0.6%2024-07-09

    Windows Image Acquisition Elevation of Privilege Vulnerability

20. 6.7CVE-2024-38013EPSS 0.6%2024-07-09

    Microsoft Windows Server Backup Elevation of Privilege Vulnerability

21. 7.8CVE-2024-35261EPSS 0.7%2024-07-09

    Azure Network Watcher VM Extension Elevation of Privilege Vulnerability

22. 7.8CVE-2024-6147EPSS 0.4%2024-06-20

    Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to …

23. 6.7CVE-2024-5742EPSS 0.3%2024-06-12

    A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a…

24. 7.1CVE-2024-35254EPSS 0.8%2024-06-11

    Azure Monitor Agent Elevation of Privilege Vulnerability

25. 4.4CVE-2024-35253EPSS 0.7%2024-06-11

    Microsoft Azure File Sync Elevation of Privilege Vulnerability

26. 7.8CVE-2024-30104EPSS 1.5%2024-06-11

    Microsoft Office Remote Code Execution Vulnerability

27. 7.3CVE-2024-30093EPSS 1.1%2024-06-11

    Windows Storage Elevation of Privilege Vulnerability

28. 6.8CVE-2024-30076EPSS 1.7%2024-06-11

    Windows Container Manager Service Elevation of Privilege Vulnerability

29. 5.5CVE-2024-30065EPSS 0.8%2024-06-11

    Windows Themes Denial of Service Vulnerability

30. 6.7CVE-2024-35235EPSS 2.4%2024-06-11

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd proc…

31. 5.5CVE-2024-36306EPSS 0.6%2024-06-10

    A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-service condition on affected installations. Please note: an attacker must fir…

32. 7.8CVE-2024-36305EPSS 0.9%2024-06-10

    A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code o…

33. 6.3CVE-2024-27885EPSS 0.3%2024-06-10

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to modify protected parts of the file system.

34. 7.3CVE-2024-5102EPSS 0.2%2024-06-10

    A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\SYSTEM. The vulnerability exists within the "Repair" (set…

35. 9.1CVE-2024-3829EPSS 0.9%2024-06-03

    qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file rea…

36. 7.8CVE-2024-4454EPSS 0.4%2024-05-22

    WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User in…

37. 7.8CVE-2023-51636EPSS 1.0%2024-05-22

    Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avira Prime. An attacker must first obtain the ability to execute low-privil…

38. 7.8CVE-2024-30060EPSS 0.5%2024-05-16

    Azure Monitor Agent Elevation of Privilege Vulnerability

39. 9.0CVE-2024-32002EPSS 29%2024-05-14

    Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not…

40. 7.0CVE-2024-30033EPSS 1.0%2024-05-14

    Windows Search Service Elevation of Privilege Vulnerability

41. 7.8CVE-2024-30018EPSS 0.9%2024-05-14

    Windows Kernel Elevation of Privilege Vulnerability

42. 7.8CVE-2024-26238EPSS 0.8%2024-05-14

    Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability

43. 7.8CVE-2024-3037EPSS 0.4%2024-05-14

    An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting…

44. 6.7CVE-2024-31952EPSS 0.2%2024-05-14

    An issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the installation process, an attacker can escalate privileges via arbitrary file permission writes. (The attacker must already have user privilege…

45. 7.8CVE-2023-50226EPSS 0.7%2024-05-03

    Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability t…

46. 7.8CVE-2023-50197EPSS 0.2%2024-05-03

    Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must firs…

47. 7.8CVE-2023-42126EPSS 0.4%2024-05-03

    G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first …

48. 7.8CVE-2023-42125EPSS 0.4%2024-05-03

    Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtai…

49. 7.8CVE-2023-42099EPSS 0.3%2024-05-03

    Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must firs…

50. 4.6CVE-2023-34283EPSS 0.6%2024-05-03

    NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability. This vulnerability allows physically present attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not…