Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1520 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2011-1136 2 Debian, Tesseract Project 2 Debian Linux, Tesseract 2024-11-21 4.7 Medium
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
CVE-2010-4817 2 Debian, Pithos Project 2 Debian Linux, Pithos 2024-11-21 5.5 Medium
pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.
CVE-2010-3095 1 Mailscanner 1 Mailscanner 2024-11-21 4.7 Medium
mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists because of an incomplete fix for CVE-2008-5313.
CVE-2010-2064 1 Rpcbind Project 1 Rpcbind 2024-11-21 7.1 High
rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr.
CVE-2010-0398 1 Autokey Project 1 Autokey 2024-11-21 6.5 Medium
The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
CVE-2009-0035 1 Alsa-project 1 Alsa 2024-11-21 5.5 Medium
alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts.
CVE-2008-7273 1 Getfiregpg 1 Iceweasel-firegpg 2024-11-21 7.8 High
A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.
CVE-2024-41738 1 Ibm 1 Txseries For Multiplatforms 2024-11-14 5.9 Medium
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
CVE-2024-51721 1 Blackberry 1 Secusuite 2024-11-13 7.3 High
A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege.
CVE-2024-44258 1 Apple 4 Ipados, Iphone Os, Tvos and 1 more 2024-11-06 7.1 High
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files.
CVE-2024-44264 1 Apple 1 Macos 2024-10-30 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious app may be able to create symlinks to protected regions of the disk.
CVE-2024-44175 1 Apple 1 Macos 2024-10-30 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
CVE-2024-45316 1 Sonicwall 1 Connect Tunnel 2024-10-15 7.8 High
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack.
CVE-2024-27458 1 Hp 40 Elite Dragonfly Firmware, Elite Dragonfly G2 Firmware, Elite Dragonfly Max Firmware and 37 more 2024-10-07 8.8 High
A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support.
CVE-2024-39578 1 Dell 1 Powerscale Onefs 2024-09-03 6.3 Medium
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.
CVE-2024-5928 1 Vipre 1 Advanced Security 2024-08-23 7.8 High
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22315.
CVE-2024-40464 1 Beego 1 Beego 2024-08-15 8.8 High
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
CVE-2024-32931 1 Johnsoncontrols 1 Exacqvision Web Service 2024-08-09 5.7 Medium
Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.
CVE-2024-41265 1 Linuxfoundation 1 Cortex 2024-08-02 7.5 High
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
CVE-2024-41253 1 Goframe 1 Goframe 2024-08-01 7.1 High
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.