Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CVEs (1,606)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2003-1528 1Fujitsu 1Siemens Networker Apr 16, 2026 Dec 31, 2003 N/A· v4 N/A· v3 7.2 HIGH· v2 nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
CVE-2003-1492 2Mozilla Netscape 2Firefox Navigator Apr 16, 2026 Dec 31, 2003 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
CVE-2003-1233 1Pedestalsoftware 1Integrity Protection Driver Apr 16, 2026 Dec 31, 2003 N/A· v4 9.8 CRITICAL· v3 2.1 LOW· v2 Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function...Show more Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.Show less
CVE-2003-0844 1Schroepl 1Mod Gzip Apr 16, 2026 Nov 17, 2003 N/A· v4 7.1 HIGH· v3 2.1 LOW· v2 mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary f...Show more mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.Show less
CVE-2003-0578 1Ibm 1U2 Universe Apr 16, 2026 Aug 18, 2003 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 cci_dir in IBM U2 UniVerse 10.0.0.9 and earlier creates hard links and unlinks files as root, which allows local users to gain privileges by deleting and overwriting arbitrary files.
CVE-2003-0517 1Mgetty Project 1Mgetty Apr 16, 2026 Aug 18, 2003 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.
CVE-2002-2382 1Cvsup 1Cvsup Apr 16, 2026 Dec 31, 2002 N/A· v4 N/A· v3 7.2 HIGH· v2 cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out.
CVE-2002-2374 1Sun 1Patchpro Apr 16, 2026 Dec 31, 2002 N/A· v4 N/A· v3 10.0 HIGH· v2 Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."
CVE-2002-2323 1Sun 1Solaris Pc Netlink Apr 16, 2026 Dec 31, 2002 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypa...Show more Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypass intended access restrictions.Show less
CVE-2002-0725 1Microsoft 2Windows 2000 Windows Nt Apr 16, 2026 Sep 5, 2002 N/A· v4 5.5 MEDIUM· v3 4.6 MEDIUM· v2 NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the targ...Show more NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file.Show less
CVE-2002-0824 1Freebsd 1Point To Point Protocol Daemon Apr 16, 2026 Aug 12, 2002 N/A· v4 N/A· v3 6.9 MEDIUM· v2 BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device.
CVE-2002-0793 1Blackberry 1Qnx Neutrino Real Time Operating System Apr 16, 2026 Aug 12, 2002 N/A· v4 5.5 MEDIUM· v3 4.6 MEDIUM· v2 Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3)...Show more Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.Show less
CVE-2001-1494 2Avaya Kernel 7Cvlan Integrated Management SuitInteractive Response+4 more Apr 16, 2026 Dec 31, 2001 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script comm...Show more script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.Show less
CVE-2001-1378 1Fetchmail 1Fetchmail Apr 16, 2026 Sep 6, 2001 N/A· v4 N/A· v3 2.1 LOW· v2 fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.
CVE-2001-1042 1Transsoft 1Broker Ftp Server Apr 16, 2026 Jul 2, 2001 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Transsoft Broker 5.9.5.0 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
CVE-2001-1386 1Texasimperialsoftware 1Wftpd Apr 16, 2026 Jul 1, 2001 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD's check for a ".lnk" extension.
CVE-2001-1043 1Argosoft 1Ftp Server Apr 16, 2026 Jul 1, 2001 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ArGoSoft FTP Server 1.2.2.2 allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
CVE-2001-0131 2Apache Debian 2Debian Linux Http Server Apr 16, 2026 Mar 12, 2001 N/A· v4 N/A· v3 3.3 LOW· v2 htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
CVE-2000-1178 1Joseph Allen 1Joe Apr 16, 2026 Jan 9, 2001 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of other users whose joe session crashes.
CVE-2000-0972 1Hp 1Hp Ux Apr 16, 2026 Dec 19, 2000 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab gene...Show more HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates.Show less

Previous 1...77 78 798081 Next