CWE:

	Topic	Date	Author
Med.	Leeloo Multipath Authorization Bypass / Symlink Attack	02.11.2022	Qualys Security Adviso...
Med.	Linux systemd Symlink Dereference Via chown_one()	27.10.2018	Jann Horn
High	MS13-097 Registry Symlink IE Sandbox Escape	27.06.2014	Juan vazquez
Med.	systemd create or overwrite arbitrary files	21.04.2014	Sebastian Krahmer
Med.	Solaris 10 Patch Cluster Symlink Attack	09.08.2012	Larry W. Cashdollar
Low	Medium severity flaw in QNX Neutrino RTOS	23.10.2011	Tim Brown
Low	Linux kernel: ZERO_SIZE_PTR dereference for long symlinks in Be FS	01.09.2011	Timo Warns
Med.	FreeBSD crontab information leakage	07.03.2011	Dan Rosenberg
Med.	The GNU C library dynamic linker expands $ORIGIN in setuid library search path	11.01.2011	taviso
Low	emesene preditable 1.6.1 temporary filename	12.06.2010	Emilio Pozuelo Monfort
Low	Mathematica on Linux /tmp/MathLink vulnerability	27.05.2010	paul szabo
Med.	Solaris Update manager and Sun Patch Cluster - Symlink attack	01.04.2010	DHS
Med.	Deliver 2.1.14 Multiple vulnerabilities	30.03.2010	Dan Rosenberg
Med.	fcrontab 3.0.4 Information Disclosure Vulnerability	09.03.2010	Dan Rosenberg
Med.	Oscailt 3.3 CMS Local File Inclusion	02.01.2010	s4r4d0
Med.	VideoCache 1.9.2 vccleaner root vulnerability	30.12.2009	Dominick LaTrappe
Med.	MySQL - 5.1.41 Multiple Vulnerabalities	03.12.2009	Jan Lieskovsky
Med.	Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities	05.02.2009	Sam Johnston
Med.	ViArt Shopping Cart v3.5 Multiple Remote Vulnerabilities	31.12.2008	XiaShing_at_gmail.com
High	verlihub <= 0.9.8d-RC2 Remote Command Execution Vulnerability	23.12.2008	v4lkyrius
High	/bin/login gives root to group utmp	02.12.2008	Paul Szabo
High	python-2.3.4-5 Symbolic link attack possibility	19.09.2008	Jan iankko Lieskovsky
Med.	Nooms 1.1	11.09.2008	irancrash

---

CVEMAP Search Results

CVE

Details

Description

2024-04-10

CVE-2024-31872

Updating...

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316.

2024-03-13

CVE-2023-32335

Updating...

IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 255075.

2024-02-05

CVE-2023-7216

Updating...

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which could be utilized to run arbitrary commands on the target system.

2024-02-02

CVE-2023-50328

Updating...

IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110.

2024-01-09

CVE-2024-0206

Updating...

A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn't normally have permission to. After a scan, the Engine would follow the links and remove the files

2023-12-09

	CVE-2023-28868	Updating...	Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link.
	CVE-2023-28869	Updating...	Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link.
	CVE-2023-28871	Updating...	Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link.

2023-09-19

CVE-2023-32182

Updating...

A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1.

2023-09-06

CVE-2023-32163

Updating...

Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Tablet Service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16857.

 

---

Copyright 2024, cxsecurity.com