Link Following

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, th

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` dr

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

RARLAB UnRAR Directory Traversal Vulnerability

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

PEAR Archive_Tar Improper Link Resolution Vulnerability

Microsoft Defender Link Following Vulnerability

Microsoft Windows Link Following Vulnerability

Microsoft Windows Storage Link Following Vulnerability

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

Git Link Following Vulnerability

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

Microsoft Task Scheduler Privilege Escalation Vulnerability

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive up

Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally.

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes) are manifest files that name the files that make up the artifact. The parser use

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass s

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

Dell/Alienware Purchased Apps, versions prior to 1.1.32.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, le

Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Inf

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authoriz

Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can e