Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CVEs (1,700)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2005-3011 1Gnu 1Texinfo Apr 16, 2026 Sep 21, 2005 N/A· v4 N/A· v3 1.2 LOW· v2 The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-1916 2Debian Ekg Project 2Debian Linux Ekg Apr 16, 2026 Jul 6, 2005 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVE-2005-1879 1Lutel 1Lutelwall Apr 16, 2026 Jun 9, 2005 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-1880 1Everybuddy 1Everybuddy Apr 16, 2026 Jun 6, 2005 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-1111 3Canonical DebianGnu 3Cpio Debian LinuxUbuntu Linux Apr 16, 2026 May 2, 2005 N/A· v4 4.7 MEDIUM· v3 3.7 LOW· v2 Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompre...Show more Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.Show less
CVE-2005-0824 1Mathopd 1Mathopd Apr 16, 2026 May 2, 2005 N/A· v4 5.5 MEDIUM· v3 3.6 LOW· v2 The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are trig...Show more The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are triggered by a SIGWINCH signal.Show less
CVE-2005-0004 3Debian MariadbOracle 3Debian Linux MariadbMysql Apr 16, 2026 Apr 14, 2005 N/A· v4 N/A· v3 4.6 MEDIUM· v2 The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack...Show more The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.Show less
CVE-2005-0587 1Mozilla 2Firefox Mozilla Apr 16, 2026 Mar 25, 2005 N/A· v4 6.5 MEDIUM· v3 2.6 LOW· v2 Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced i...Show more Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.Show less
CVE-2004-0967 1Aladdin Enterprises 1Ghostscript Apr 16, 2026 Feb 9, 2005 N/A· v4 N/A· v3 7.2 HIGH· v2 The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a...Show more The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.Show less
CVE-2004-2473 1Wmfrog 1Wmfrog Apr 16, 2026 Dec 31, 2004 N/A· v4 N/A· v3 1.2 LOW· v2 wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2004-1901 1Gentoo 2Linux Portage Apr 16, 2026 Dec 31, 2004 N/A· v4 5.5 MEDIUM· v3 4.6 MEDIUM· v2 Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
CVE-2004-1603 1Cpanel 1Cpanel Apr 16, 2026 Oct 18, 2004 N/A· v4 5.5 MEDIUM· v3 5.0 MEDIUM· v2 cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabl...Show more cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.Show less
CVE-2004-0689 2Debian Kde 2Debian Linux Kde Apr 16, 2026 Sep 28, 2004 N/A· v4 7.1 HIGH· v3 4.6 MEDIUM· v2 KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files.
CVE-2004-0217 1Symantec 1Antivirus Scan Engine Apr 16, 2026 Apr 15, 2004 N/A· v4 7.0 HIGH· v3 3.7 LOW· v2 The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink attack on /tmp/LiveUpdate.log.
CVE-2003-1528 1Fujitsu 1Siemens Networker Apr 16, 2026 Dec 31, 2003 N/A· v4 N/A· v3 7.2 HIGH· v2 nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
CVE-2003-1492 2Mozilla Netscape 2Firefox Navigator Apr 16, 2026 Dec 31, 2003 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
CVE-2003-1233 1Pedestalsoftware 1Integrity Protection Driver Apr 16, 2026 Dec 31, 2003 N/A· v4 9.8 CRITICAL· v3 2.1 LOW· v2 Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function...Show more Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.Show less
CVE-2003-0844 1Schroepl 1Mod Gzip Apr 16, 2026 Nov 17, 2003 N/A· v4 7.1 HIGH· v3 2.1 LOW· v2 mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary f...Show more mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.Show less
CVE-2003-0578 1Ibm 1U2 Universe Apr 16, 2026 Aug 18, 2003 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 cci_dir in IBM U2 UniVerse 10.0.0.9 and earlier creates hard links and unlinks files as root, which allows local users to gain privileges by deleting and overwriting arbitrary files.
CVE-2003-0517 1Mgetty Project 1Mgetty Apr 16, 2026 Aug 18, 2003 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.

Previous 1...81 82 838485 Next