Filtered by CWE-59
Filtered by vendor Subscriptions
Total 1452 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-30371 1 Metabase 1 Metabase 2025-07-12 N/A
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
CVE-2023-24904 1 Microsoft 1 Windows Server 2008 2025-07-10 7.1 High
Windows Installer Elevation of Privilege Vulnerability
CVE-2023-29343 1 Microsoft 1 Windows Sysmon 2025-07-10 7.8 High
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
CVE-2024-38098 1 Microsoft 1 Azure Connected Machine Agent 2025-07-10 7.8 High
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-38084 1 Microsoft 1 Officeplus 2025-07-10 7.8 High
Microsoft OfficePlus Elevation of Privilege Vulnerability
CVE-2025-41668 2025-07-08 8.8 High
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
CVE-2025-41666 2025-07-08 8.8 High
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
CVE-2025-41667 2025-07-08 8.8 High
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
CVE-2024-49051 1 Microsoft 1 Pc Manager 2025-07-08 7.8 High
Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2024-43603 1 Microsoft 4 Visual Studio, Visual Studio 2017, Visual Studio 2019 and 1 more 2025-07-08 5.5 Medium
Visual Studio Collector Service Denial of Service Vulnerability
CVE-2024-43551 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2025-07-08 7.8 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-43501 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-08 7.8 High
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-38097 1 Microsoft 1 Azure Monitor Agent 2025-07-08 7.1 High
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2025-53109 2025-07-03 N/A
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.
CVE-2024-36486 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
CVE-2024-52561 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
CVE-2024-54189 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
CVE-2020-3432 1 Cisco 1 Anyconnect Secure Mobility Client 2025-06-24 5.6 Medium
A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file in the filesystem. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a symbolic link (symlink) to a target file on a specific path. A successful exploit could allow the attacker to corrupt the contents of the file. If the file is a critical systems file, the exploit could lead to a denial of service condition. To exploit this vulnerability, the attacker would need to have valid credentials on the system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2023-52094 1 Trendmicro 1 Apex One 2025-06-20 7.8 High
An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2023-52092 1 Trendmicro 1 Apex One 2025-06-20 7.8 High
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.