CWE-59

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Window

Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A phys

Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder.

Windows Cleanup Manager Elevation of Privilege Vulnerability

This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is c

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an att

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlin

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local a

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5,

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore r

A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unkno

Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP fi

Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of

Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source c

In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local infor

An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022

In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local informatio

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 a

Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (dur

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on t

FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Je

Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of s

By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Preve

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Over

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite

`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the n

Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote at

A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-20

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do

Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository th

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and es

Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform

Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevate

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-d

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlin

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can

An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group P

Windows Update Stack Elevation of Privilege Vulnerability

Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, lo

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissio

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in t

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (o