← Back
CWE-59

1,606 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

JSON object

Loading...

CVEs (1,606)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-5851
1Openbase International Ltd
1Openbase
Apr 23, 2026
Nov 10, 2006
N/A· v4
N/A· v3
2.1 LOW· v2
openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328.
CVE-2006-1247
1Ibm
1Aix
Apr 16, 2026
Apr 19, 2006
N/A· v4
N/A· v3
3.3 LOW· v2
rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-3126
1Antiword
1Antiword
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
1.9 LOW· v2
The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.
CVE-2005-2714
1Apple
2Mac Os X
Mac Os X Server
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
6.8 MEDIUM· v2
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file.
CVE-2005-2527
1Sun
1Java
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
1.2 LOW· v2
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symli...Show more
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.Show less
CVE-2005-3349
1Gnu
1Gnump3d
Apr 16, 2026
Nov 18, 2005
N/A· v4
N/A· v3
1.9 LOW· v2
GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file.
CVE-2005-3011
1Gnu
1Texinfo
Apr 16, 2026
Sep 21, 2005
N/A· v4
N/A· v3
1.2 LOW· v2
The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-1916
2Debian
Ekg Project
2Debian Linux
Ekg
Apr 16, 2026
Jul 6, 2005
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVE-2005-1879
1Lutel
1Lutelwall
Apr 16, 2026
Jun 9, 2005
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-1880
1Everybuddy
1Everybuddy
Apr 16, 2026
Jun 6, 2005
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-1111
3Canonical
DebianGnu
3Cpio
Debian LinuxUbuntu Linux
Apr 16, 2026
May 2, 2005
N/A· v4
4.7 MEDIUM· v3
3.7 LOW· v2
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompre...Show more
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.Show less
CVE-2005-0824
1Mathopd
1Mathopd
Apr 16, 2026
May 2, 2005
N/A· v4
5.5 MEDIUM· v3
3.6 LOW· v2
The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are trig...Show more
The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are triggered by a SIGWINCH signal.Show less
CVE-2005-0004
3Debian
MariadbOracle
3Debian Linux
MariadbMysql
Apr 16, 2026
Apr 14, 2005
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack...Show more
The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.Show less
CVE-2005-0587
1Mozilla
2Firefox
Mozilla
Apr 16, 2026
Mar 25, 2005
N/A· v4
6.5 MEDIUM· v3
2.6 LOW· v2
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced i...Show more
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.Show less
CVE-2004-0967
1Aladdin Enterprises
1Ghostscript
Apr 16, 2026
Feb 9, 2005
N/A· v4
N/A· v3
7.2 HIGH· v2
The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a...Show more
The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.Show less
CVE-2004-2473
1Wmfrog
1Wmfrog
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
1.2 LOW· v2
wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2004-1901
1Gentoo
2Linux
Portage
Apr 16, 2026
Dec 31, 2004
N/A· v4
5.5 MEDIUM· v3
4.6 MEDIUM· v2
Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
CVE-2004-1603
1Cpanel
1Cpanel
Apr 16, 2026
Oct 18, 2004
N/A· v4
5.5 MEDIUM· v3
5.0 MEDIUM· v2
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabl...Show more
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.Show less
CVE-2004-0689
2Debian
Kde
2Debian Linux
Kde
Apr 16, 2026
Sep 28, 2004
N/A· v4
7.1 HIGH· v3
4.6 MEDIUM· v2
KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files.
CVE-2004-0217
1Symantec
1Antivirus Scan Engine
Apr 16, 2026
Apr 15, 2004
N/A· v4
7.0 HIGH· v3
3.7 LOW· v2
The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink attack on /tmp/LiveUpdate.log.