CWE-59
Improper Link Resolution Before File Access ('Link Following')
Description
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-132 · CAPEC-17 · CAPEC-35 · CAPEC-76
CVEs mapped to this weakness (818)
page 41 of 41| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2007-1027 | 0.00 | — | 0.00 | Feb 21, 2007 | Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file. | |||
| CVE-2006-1247 | 0.00 | — | 0.00 | Apr 19, 2006 | rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2005-3126 | 0.00 | — | 0.00 | Dec 31, 2005 | The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files. | |||
| CVE-2005-2714 | 0.00 | — | 0.01 | Dec 31, 2005 | passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file. | |||
| CVE-2005-2527 | 0.00 | — | 0.00 | Dec 31, 2005 | Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack. | |||
| CVE-2005-3349 | 0.00 | — | 0.00 | Nov 18, 2005 | GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file. | |||
| CVE-2005-3011 | 0.00 | — | 0.01 | Sep 21, 2005 | The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2005-0004 | 0.00 | — | 0.01 | Apr 14, 2005 | The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files. | |||
| CVE-2004-0967 | 0.00 | — | 0.00 | Feb 9, 2005 | The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files. | |||
| CVE-2004-2473 | 0.00 | — | 0.00 | Dec 31, 2004 | wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2003-1528 | 0.00 | — | 0.00 | Dec 31, 2003 | nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file. | |||
| CVE-2003-1492 | 0.00 | — | 0.01 | Dec 31, 2003 | Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end. | |||
| CVE-2002-2382 | 0.00 | — | 0.00 | Dec 31, 2002 | cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out. | |||
| CVE-2002-2374 | 0.00 | — | 0.01 | Dec 31, 2002 | Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files." | |||
| CVE-2001-1378 | 0.00 | — | 0.00 | Sep 6, 2001 | fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files. | |||
| CVE-2001-0131 | 0.00 | — | 0.02 | Mar 12, 2001 | htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. | |||
| CVE-2000-0715 | 0.00 | — | 0.00 | Oct 20, 2000 | DiskCheck script diskcheck.pl in Red Hat Linux 6.2 allows local users to create or overwrite arbitrary files via a symlink attack on a temporary file. | |||
| CVE-1999-0794 | 0.00 | — | 0.01 | Oct 1, 1999 | Microsoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file. |
- CVE-2007-1027Feb 21, 2007risk 0.00cvss —epss 0.00
Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.
- CVE-2006-1247Apr 19, 2006risk 0.00cvss —epss 0.00
rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2005-3126Dec 31, 2005risk 0.00cvss —epss 0.00
The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.
- CVE-2005-2714Dec 31, 2005risk 0.00cvss —epss 0.01
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file.
- CVE-2005-2527Dec 31, 2005risk 0.00cvss —epss 0.00
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.
- CVE-2005-3349Nov 18, 2005risk 0.00cvss —epss 0.00
GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file.
- CVE-2005-3011Sep 21, 2005risk 0.00cvss —epss 0.01
The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2005-0004Apr 14, 2005risk 0.00cvss —epss 0.01
The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.
- CVE-2004-0967Feb 9, 2005risk 0.00cvss —epss 0.00
The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.
- CVE-2004-2473Dec 31, 2004risk 0.00cvss —epss 0.00
wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2003-1528Dec 31, 2003risk 0.00cvss —epss 0.00
nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
- CVE-2003-1492Dec 31, 2003risk 0.00cvss —epss 0.01
Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
- CVE-2002-2382Dec 31, 2002risk 0.00cvss —epss 0.00
cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out.
- CVE-2002-2374Dec 31, 2002risk 0.00cvss —epss 0.01
Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."
- CVE-2001-1378Sep 6, 2001risk 0.00cvss —epss 0.00
fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.
- CVE-2001-0131Mar 12, 2001risk 0.00cvss —epss 0.02
htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
- CVE-2000-0715Oct 20, 2000risk 0.00cvss —epss 0.00
DiskCheck script diskcheck.pl in Red Hat Linux 6.2 allows local users to create or overwrite arbitrary files via a symlink attack on a temporary file.
- CVE-1999-0794Oct 1, 1999risk 0.00cvss —epss 0.01
Microsoft Excel does not warn a user when a macro is present in a Symbolic Link (SYLK) format file.