Vulnerabilities > Improper Link Resolution Before File Access ('Link Following')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-06-12 | CVE-2019-1053 | Link Following vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts, aka 'Windows Shell Elevation of Privilege Vulnerability'. | 8.8 |
| 2019-06-12 | CVE-2019-0986 | Link Following vulnerability in Microsoft products An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'. | 7.1 |
| 2019-06-11 | CVE-2019-12749 | Link Following vulnerability in multiple products dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. | 7.1 |
| 2019-06-07 | CVE-2019-12779 | Link Following vulnerability in Clusterlabs Libqb libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL. | 7.1 |
| 2019-06-04 | CVE-2019-12209 | Link Following vulnerability in Yubico Pam-U2F 1.0.7 Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. | 7.5 |
| 2019-06-03 | CVE-2019-3567 | Link Following vulnerability in Linuxfoundation Osquery In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. | 8.1 |
| 2019-05-23 | CVE-2019-9949 | Link Following vulnerability in Westerndigital products Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. | 8.8 |
| 2019-05-16 | CVE-2019-0936 | Link Following vulnerability in Microsoft products An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vulnerability'. | 7.8 |
| 2019-05-10 | CVE-2019-5438 | Link Following vulnerability in Harpjs Harp Path traversal using symlink in npm harp module versions <= 0.29.0. | 5.3 |
| 2019-05-10 | CVE-2019-11879 | Link Following vulnerability in Ruby-Lang Webrick 1.4.2 The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. | 5.5 |