← Back
CWE-59

1,606 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

JSON object

Loading...

CVEs (1,606)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-5940
1Tug
1Texlive 2007
Apr 23, 2026
Nov 13, 2007
N/A· v4
N/A· v3
4.6 MEDIUM· v2
feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.
CVE-2007-4129
1Fedoraproject
1Coolkey
Apr 23, 2026
Nov 8, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory.
CVE-2007-3921
1Gforge
1Gforge
Apr 23, 2026
Nov 8, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files.
CVE-2007-5839
1Bitchx
1Bitchx
Apr 23, 2026
Nov 6, 2007
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The e_hostname function in commands.c in BitchX 1.1a allows local users to overwrite arbitrary files via a symlink attack on temporary files when using the (1) HOSTNAME or (2) IRCHOST command.
CVE-2007-5805
1Ibm
1Aix
Apr 23, 2026
Nov 5, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via...Show more
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via a symlink attack involving use of the file's name as the argument. NOTE: this issue is due to an incomplete fix for CVE-2007-5804.Show less
CVE-2007-5718
1Vobcopy
1Vobcopy
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
4.9 MEDIUM· v2
vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.
CVE-2007-5695
1Sitebar
1Sitebar
Apr 23, 2026
Oct 29, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action.
CVE-2007-3919
1Xensource Inc
1Xen
Apr 23, 2026
Oct 28, 2007
N/A· v4
N/A· v3
6.0 MEDIUM· v2
(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.
CVE-2007-5200
1Opensuse
1Opensuse
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file.
CVE-2007-5437
1Broadcom
1Etrust Integrated Threat Management
Apr 23, 2026
Oct 13, 2007
N/A· v4
N/A· v3
5.8 MEDIUM· v2
The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
CVE-2007-5377
1Gnu
1Tramp
Apr 23, 2026
Oct 12, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on...Show more
The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.Show less
CVE-2007-5207
1Debian
1Guilt
Apr 23, 2026
Oct 4, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
guilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log.[PID] temporary file.
CVE-2007-3916
1Skk Openlab
1Skk Tools
Apr 23, 2026
Sep 24, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.
CVE-2007-4652
1Php
1Php
Apr 23, 2026
Sep 4, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.
CVE-2007-4631
1Qgit
1Qgit
Apr 23, 2026
Aug 31, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with pred...Show more
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.Show less
CVE-2007-4224
1Kde
1Konqueror
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.
CVE-2007-3742
1Apple
1Safari
Apr 23, 2026
Aug 3, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to cre...Show more
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks.Show less
CVE-2007-3103
2Fedoraproject
Redhat
4Enterprise Linux
Enterprise Linux DesktopFedora Core+1 more
Apr 23, 2026
Jul 15, 2007
N/A· v4
N/A· v3
6.2 MEDIUM· v2
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
CVE-2007-2978
1Eggblog
1Eggblog
Apr 23, 2026
Jun 1, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2007-1027
1Ibm
1Db2
Apr 23, 2026
Feb 21, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.