CWE-59: Improper Link Resolution Before File Access (Link Following), page 22

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

1. 5.5CVE-2021-32553EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

2. 5.5CVE-2021-32552EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.

3. 5.5CVE-2021-32551EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.

4. 5.5CVE-2021-32550EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.

5. 5.5CVE-2021-32549EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.

6. 5.5CVE-2021-32548EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.

7. 5.5CVE-2021-32547EPSS 0.3%2021-06-12

   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.

8. 7.8CVE-2021-31997EPSS 0.3%2021-06-10

   A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-pos…

9. 7.8CVE-2021-0094EPSS 0.3%2021-06-09

   Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.

10. 7.8CVE-2020-15076EPSS 0.4%2021-05-26

    Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp.

11. 7.8CVE-2020-9452EPSS 0.5%2021-05-25

    An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unp…

12. 7.1CVE-2020-27833EPSS 1.7%2021-05-14

    A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to …

13. 7.0CVE-2021-23892EPSS 0.2%2021-05-12

    By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process, a local user can perform a privilege escalation attack to obtain …

14. 7.8CVE-2021-23872EPSS 0.4%2021-05-12

    Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface.

15. 7.8CVE-2021-31187EPSS 1.1%2021-05-11

    Windows WalletService Elevation of Privilege Vulnerability

16. 7.8CVE-2020-28007EPSS 0.5%2021-05-06

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the fi…

17. 5.5CVE-2021-27851EPSS 0.3%2021-04-26

    A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build proces…

18. 8.1CVE-2021-30356EPSS 1.0%2021-04-22

    A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files.

19. 7.8CVE-2021-28098EPSS 0.4%2021-04-14

    An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMD…

20. 7.8CVE-2021-28321EPSS 1.3%2021-04-13

    Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

21. 7.8CVE-2021-30463EPSS 0.5%2021-04-08

    VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin passwo…

22. 3.9CVE-2020-36314EPSS 0.6%2021-04-07

    fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situat…

23. 2.7CVE-2021-28163EPSS 4.2%2021-04-01

    In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the we…

24. 7.1CVE-2020-15075EPSS 0.3%2021-03-30

    OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp.

25. 6.1CVE-2021-27241EPSS 0.3%2021-03-29

    This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the …

26. 6.3CVE-2021-20197EPSS 0.3%2021-03-26

    There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating bin…

27. 7.8CVE-2020-7346EPSS 0.4%2021-03-23

    Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This …

28. 5.5CVE-2021-28650EPSS 0.5%2021-03-17

    autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex s…

29. 5.3CVE-2021-28153EPSS 2.7%2021-03-11

    An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file,…

30. 7.8CVE-2021-26889EPSS 1.2%2021-03-11

    Windows Update Stack Elevation of Privilege Vulnerability

31. 7.8CVE-2021-26887EPSS 1.1%2021-03-11

    An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited t…

32. 7.0CVE-2021-26873EPSS 1.1%2021-03-11

    Windows User Profile Service Elevation of Privilege Vulnerability

33. 7.1CVE-2021-26866EPSS 1.2%2021-03-11

    Windows Update Service Elevation of Privilege Vulnerability

34. 7.0CVE-2021-26862EPSS 1.2%2021-03-11

    Windows Installer Elevation of Privilege Vulnerability

35. 5.5CVE-2020-4717EPSS 0.3%2021-03-10

    A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary file in another protected path during product installation. IBM X-Force ID: 187727.

36. 7.8CVE-2021-3310EPSS 1.0%2021-03-10

    Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).

37. 7.5CVE-2021-21300ExploitEPSS 89%2021-03-09

    Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out scr…

38. 5.5CVE-2021-24084EPSS 2.7%2021-02-25

    Windows Mobile Device Management Information Disclosure Vulnerability

39. 7.8CVE-2020-12878EPSS 0.5%2021-02-18

    Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.

40. 7.8CVE-2021-26720EPSS 0.4%2021-02-17

    avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on…

41. 8.8CVE-2021-27229EPSS 3.2%2021-02-16

    Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text.

42. 6.1CVE-2021-23873EPSS 0.7%2021-02-10

    Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulat…

43. 6.5CVE-2021-21131EPSS 7.6%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

44. 8.1CVE-2021-21125EPSS 8.1%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

45. 7.8CVE-2021-21117EPSS 0.2%2021-02-09

    Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a crafted file.

46. 5.5CVE-2020-36241EPSS 0.6%2021-02-05

    autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outs…

47. 5.5CVE-2020-8585EPSS 0.4%2021-01-28

    OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink).

48. 7.7CVE-2021-21272EPSS 1.5%2021-01-25

    ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnera…

49. 4.3CVE-2020-4966EPSS 1.4%2021-01-21

    IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this li…

50. 7.5CVE-2021-1278EPSS 1.7%2021-01-20

    Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details sect…