Filtered by CWE-59
Filtered by vendor Subscriptions
Total 1498 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-1491 1 Cisco 1 Catalyst Sd-wan Manager 2025-08-04 N/A
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the file system and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the file system of the underlying operating system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2025-0146 1 Zoom 5 Meeting Software Development Kit, Rooms, Rooms Controller and 2 more 2025-08-01 3.9 Low
Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.
CVE-2023-20004 1 Cisco 2 Roomos, Telepresence Collaboration Endpoint 2025-07-30 4.4 Medium
Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVE-2025-1079 3 Apple, Google, Linux 3 Macos, Web Designer, Linux Kernel 2025-07-29 7.8 High
Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature
CVE-2025-25185 1 Binary-husky 1 Gpt Academic 2025-07-12 7.5 High
GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it. Subsequently, when accessing the decompressed file from the server, the soft link will point to the target file on the victim server. The vulnerability allows attackers to read all files on the server.
CVE-2023-24904 1 Microsoft 1 Windows Server 2008 2025-07-10 7.1 High
Windows Installer Elevation of Privilege Vulnerability
CVE-2023-29343 1 Microsoft 1 Windows Sysmon 2025-07-10 7.8 High
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
CVE-2024-38098 1 Microsoft 1 Azure Connected Machine Agent 2025-07-10 7.8 High
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-38084 1 Microsoft 1 Officeplus 2025-07-10 7.8 High
Microsoft OfficePlus Elevation of Privilege Vulnerability
CVE-2024-49051 1 Microsoft 1 Pc Manager 2025-07-08 7.8 High
Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2024-43603 1 Microsoft 4 Visual Studio, Visual Studio 2017, Visual Studio 2019 and 1 more 2025-07-08 5.5 Medium
Visual Studio Collector Service Denial of Service Vulnerability
CVE-2024-43551 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2025-07-08 7.8 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-43501 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-08 7.8 High
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-38097 1 Microsoft 1 Azure Monitor Agent 2025-07-08 7.1 High
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-36486 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
CVE-2024-52561 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
CVE-2024-54189 1 Parallels 1 Parallels Desktop 2025-07-02 7.8 High
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
CVE-2020-3432 1 Cisco 1 Anyconnect Secure Mobility Client 2025-06-24 5.6 Medium
A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file in the filesystem. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a symbolic link (symlink) to a target file on a specific path. A successful exploit could allow the attacker to corrupt the contents of the file. If the file is a critical systems file, the exploit could lead to a denial of service condition. To exploit this vulnerability, the attacker would need to have valid credentials on the system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2023-52094 1 Trendmicro 1 Apex One 2025-06-20 7.8 High
An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2023-52092 1 Trendmicro 1 Apex One 2025-06-20 7.8 High
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.