CWE:

	Topic	Date	Author
Med.	Leeloo Multipath Authorization Bypass / Symlink Attack	02.11.2022	Qualys Security Adviso...
Med.	Linux systemd Symlink Dereference Via chown_one()	27.10.2018	Jann Horn
High	MS13-097 Registry Symlink IE Sandbox Escape	27.06.2014	Juan vazquez
Med.	systemd create or overwrite arbitrary files	21.04.2014	Sebastian Krahmer
Med.	Solaris 10 Patch Cluster Symlink Attack	09.08.2012	Larry W. Cashdollar
Low	Medium severity flaw in QNX Neutrino RTOS	23.10.2011	Tim Brown
Low	Linux kernel: ZERO_SIZE_PTR dereference for long symlinks in Be FS	01.09.2011	Timo Warns
Med.	FreeBSD crontab information leakage	07.03.2011	Dan Rosenberg
Med.	The GNU C library dynamic linker expands $ORIGIN in setuid library search path	11.01.2011	taviso
Low	emesene preditable 1.6.1 temporary filename	12.06.2010	Emilio Pozuelo Monfort
Low	Mathematica on Linux /tmp/MathLink vulnerability	27.05.2010	paul szabo
Med.	Solaris Update manager and Sun Patch Cluster - Symlink attack	01.04.2010	DHS
Med.	Deliver 2.1.14 Multiple vulnerabilities	30.03.2010	Dan Rosenberg
Med.	fcrontab 3.0.4 Information Disclosure Vulnerability	09.03.2010	Dan Rosenberg
Med.	Oscailt 3.3 CMS Local File Inclusion	02.01.2010	s4r4d0
Med.	VideoCache 1.9.2 vccleaner root vulnerability	30.12.2009	Dominick LaTrappe
Med.	MySQL - 5.1.41 Multiple Vulnerabalities	03.12.2009	Jan Lieskovsky
Med.	Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities	05.02.2009	Sam Johnston
Med.	ViArt Shopping Cart v3.5 Multiple Remote Vulnerabilities	31.12.2008	XiaShing_at_gmail.com
High	verlihub <= 0.9.8d-RC2 Remote Command Execution Vulnerability	23.12.2008	v4lkyrius
High	/bin/login gives root to group utmp	02.12.2008	Paul Szabo
High	python-2.3.4-5 Symbolic link attack possibility	19.09.2008	Jan iankko Lieskovsky
Med.	Nooms 1.1	11.09.2008	irancrash

---

CVEMAP Search Results

CVE

Details

Description

2023-04-17

CVE-2023-28972

Updating...

An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on NFX Series systems, leading to a possible administrative bypass with physical access to the console. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. This is similar to the vulnerability described in CVE-2019-0035 but affects different platforms and in turn requires a different fix. This issue affects Juniper Networks Junos OS on NFX Series: 19.2 versions prior to 19.2R3-S7; 19.3 versions prior to 19.3R3-S8; 19.4 versions prior to 19.4R3-S12; 20.2 versions prior to 20.2R3-S8; 20.4 versions prior to 20.4R3-S7; 21.1 versions prior to 21.1R3-S5; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R3-S1; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2.

2023-04-05

CVE-2023-22291

Updating...

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt to free a stack pointer, which causes memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

2023-04-04

CVE-2023-25940

Updating...

Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover and it breaks the compliance mode guarantees.

2023-02-09

CVE-2023-25168

Updating...

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.

2023-02-08

CVE-2023-25152

Updating...

Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known workarounds for this vulnerability. ### Workarounds None at this time.

2022-12-28

CVE-2022-4812

Updating...

Comparison of Object References Instead of Object Contents in GitHub repository usememos/memos prior to 0.9.1.

2022-12-19

CVE-2021-4259

Updating...

A vulnerability was found in phpRedisAdmin up to 1.17.3. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216267.

2022-12-16

CVE-2022-4563

Updating...

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is b0526a06f8ca713cce74b63e00d3730618d89691. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215972.

2022-12-08

CVE-2022-4122

Updating...

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

2022-10-26

CVE-2022-31256

Updating...

A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.

 

---

Copyright 2023, cxsecurity.com