← Back
CWE-59

1,700 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

JSON object

Loading...

CVEs (1,700)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-1078
2Gentoo
Rpath
2Linux
Rpath Linux
Apr 23, 2026
Feb 29, 2008
N/A· v4
N/A· v3
7.2 HIGH· v2
expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same iss...Show more
expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1.Show less
CVE-2008-0870
2Bea Systems
Oracle
2Weblogic Portal
Weblogic Portal
Apr 23, 2026
Feb 21, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to s...Show more
BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.Show less
CVE-2008-0806
1Paul Pelzl
1Wyrd
Apr 23, 2026
Feb 19, 2008
N/A· v4
N/A· v3
3.6 LOW· v2
wyrd 1.4.3b allows local users to overwrite arbitrary files via a symlink attack on the wyrd-tmp.[USERID] temporary file.
CVE-2008-0732
1Apache
1Geronimo
Apr 23, 2026
Feb 12, 2008
N/A· v4
N/A· v3
2.1 LOW· v2
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
CVE-2008-0163
1Linux
1Linux Kernel
Apr 23, 2026
Feb 12, 2008
N/A· v4
N/A· v3
4.4 MEDIUM· v2
Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
CVE-2008-0666
1Website Meta Language
1Website Meta Language
Apr 23, 2026
Feb 11, 2008
N/A· v4
N/A· v3
3.6 LOW· v2
Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on (1) the /tmp/pe.tmp.$$ temporary file used by wml_contrib/wmg.cgi and (2) temporary files used by wml_backend/p3_...Show more
Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on (1) the /tmp/pe.tmp.$$ temporary file used by wml_contrib/wmg.cgi and (2) temporary files used by wml_backend/p3_eperl/eperl_sys.c.Show less
CVE-2008-0665
1Website Meta Language
1Website Meta Language
Apr 23, 2026
Feb 11, 2008
N/A· v4
N/A· v3
3.6 LOW· v2
wml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on the ipp.$$.tmp temporary file.
CVE-2008-0613
1Xoops
1Xoops
Apr 23, 2026
Feb 6, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the xoops_redirect parameter.
CVE-2007-4998
1Linux
1Linux Kernel
Apr 23, 2026
Jan 31, 2008
N/A· v4
N/A· v3
6.9 MEDIUM· v2
cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files th...Show more
cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.Show less
CVE-2008-0525
2Lumension Security
Novell
2Patchlink Update
Zenworks Patch Management Update Agent
Apr 23, 2026
Jan 31, 2008
N/A· v4
N/A· v3
4.6 MEDIUM· v2
PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symli...Show more
PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and (2) execute arbitrary code via a symlink attack on the /tmp/plshutdown file used by the rebootTask script.Show less
CVE-2007-6692
1Menalto
1Gallery
Apr 23, 2026
Jan 17, 2008
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules.
CVE-2007-6595
1Clam Anti Virus
1Clamav
Apr 23, 2026
Dec 31, 2007
N/A· v4
N/A· v3
2.1 LOW· v2
ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode i...Show more
ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.Show less
CVE-2007-6208
1Claws Mail
1Claws Mail Tools
Apr 23, 2026
Dec 4, 2007
N/A· v4
N/A· v3
3.6 LOW· v2
sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file.
CVE-2007-6061
1Audacityteam
1Audacity
Apr 23, 2026
Nov 20, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the d...Show more
Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.Show less
CVE-2007-5940
1Tug
1Texlive 2007
Apr 23, 2026
Nov 13, 2007
N/A· v4
N/A· v3
4.6 MEDIUM· v2
feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.
CVE-2007-4129
1Fedoraproject
1Coolkey
Apr 23, 2026
Nov 8, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory.
CVE-2007-3921
1Gforge
1Gforge
Apr 23, 2026
Nov 8, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files.
CVE-2007-5839
1Bitchx
1Bitchx
Apr 23, 2026
Nov 6, 2007
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The e_hostname function in commands.c in BitchX 1.1a allows local users to overwrite arbitrary files via a symlink attack on temporary files when using the (1) HOSTNAME or (2) IRCHOST command.
CVE-2007-5805
1Ibm
1Aix
Apr 23, 2026
Nov 5, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via...Show more
cfgcon in IBM AIX 5.2 and 5.3 does not properly validate the argument to the "-p" option to swcons, which allows local users in the system group to create an arbitrary file, and enable world writability of this file, via a symlink attack involving use of the file's name as the argument. NOTE: this issue is due to an incomplete fix for CVE-2007-5804.Show less
CVE-2007-5718
1Vobcopy
1Vobcopy
Apr 23, 2026
Oct 30, 2007
N/A· v4
N/A· v3
4.9 MEDIUM· v2
vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.