← Back
CWE-59

1,700 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

JSON object

Loading...

CVEs (1,700)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-5695
1Sitebar
1Sitebar
Apr 23, 2026
Oct 29, 2007
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action.
CVE-2007-3919
1Xensource Inc
1Xen
Apr 23, 2026
Oct 28, 2007
N/A· v4
N/A· v3
6.0 MEDIUM· v2
(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.
CVE-2007-5200
1Opensuse
1Opensuse
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file.
CVE-2007-5437
1Broadcom
1Etrust Integrated Threat Management
Apr 23, 2026
Oct 13, 2007
N/A· v4
N/A· v3
5.8 MEDIUM· v2
The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
CVE-2007-5377
1Gnu
1Tramp
Apr 23, 2026
Oct 12, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on...Show more
The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.Show less
CVE-2007-5207
1Debian
1Guilt
Apr 23, 2026
Oct 4, 2007
N/A· v4
N/A· v3
3.3 LOW· v2
guilt 0.27 allows local users to overwrite arbitrary files via a symlink attack on a guilt.log.[PID] temporary file.
CVE-2007-3916
1Skk Openlab
1Skk Tools
Apr 23, 2026
Sep 24, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.
CVE-2007-4652
1Php
1Php
Apr 23, 2026
Sep 4, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.
CVE-2007-4631
1Qgit
1Qgit
Apr 23, 2026
Aug 31, 2007
N/A· v4
N/A· v3
6.9 MEDIUM· v2
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with pred...Show more
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.Show less
CVE-2007-4224
1Kde
1Konqueror
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.
CVE-2007-3742
1Apple
1Safari
Apr 23, 2026
Aug 3, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to cre...Show more
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks.Show less
CVE-2007-3103
2Fedoraproject
Redhat
4Enterprise Linux
Enterprise Linux DesktopFedora Core+1 more
Apr 23, 2026
Jul 15, 2007
N/A· v4
N/A· v3
6.2 MEDIUM· v2
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
CVE-2007-2978
1Eggblog
1Eggblog
Apr 23, 2026
Jun 1, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2007-1027
1Ibm
1Db2
Apr 23, 2026
Feb 21, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.
CVE-2006-5851
1Openbase International Ltd
1Openbase
Apr 23, 2026
Nov 10, 2006
N/A· v4
N/A· v3
2.1 LOW· v2
openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328.
CVE-2006-1247
1Ibm
1Aix
Apr 16, 2026
Apr 19, 2006
N/A· v4
N/A· v3
3.3 LOW· v2
rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-3126
1Antiword
1Antiword
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
1.9 LOW· v2
The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitrary files via a symlink attack on temporary (a) output and (b) error files.
CVE-2005-2714
1Apple
2Mac Os X
Mac Os X Server
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
6.8 MEDIUM· v2
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file.
CVE-2005-2527
1Sun
1Java
Apr 16, 2026
Dec 31, 2005
N/A· v4
N/A· v3
1.2 LOW· v2
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symli...Show more
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.Show less
CVE-2005-3349
1Gnu
1Gnump3d
Apr 16, 2026
Nov 18, 2005
N/A· v4
N/A· v3
1.9 LOW· v2
GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file.