CVE Database

CVE-2023-4052 Medium · 6.5 CWE-59 Aug 1, 2023

The Firefox updater created a directory writable by non-privileged users. When uninstalling...

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

CVE-2023-36874 High · 7.8 KEV Urgent · 74 Public exploit CWE-59 Jul 11, 2023

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2023-22490 Medium · 5.5 CWE-59 Feb 14, 2023

Git vulnerable to local clone-based data exfiltration with non-local transports

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

CVE-2022-21919 High · 7.0 KEV High · 54 CWE-59 Jan 11, 2022

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2021-41379 Medium · 5.5 KEV High · 63 Ransomware CWE-59 Nov 9, 2021

Microsoft Windows Installer Privilege Escalation Vulnerability

Windows Installer Elevation of Privilege Vulnerability

CVE-2021-28153 Medium · 5.3 CWE-59 Mar 11, 2021

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with...

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

CVE-2019-20383 High · 7.8 CWE-59 Aug 13, 2020

Link Following in Abbyy Finereader

ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.

CVE-2020-0787 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-59 Mar 12, 2020

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

CVE-2020-0683 High · 7.8 KEV High · 69 Public exploit CWE-59 Feb 11, 2020

Microsoft Windows Installer Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

CVE-2020-0638 High · 7.8 KEV High · 64 Ransomware CWE-59 Jan 14, 2020

Microsoft Update Notification Manager Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

CVE-2019-1385 High · 7.8 KEV High · 64 Ransomware CWE-59 Nov 12, 2019

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.

CVE-2019-1315 High · 7.8 KEV Urgent · 70 Public exploit Ransomware CWE-59 Oct 10, 2019

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.

CVE-2019-1253 High · 7.8 KEV Urgent · 79 Public exploit Ransomware CWE-59 Sep 11, 2019

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

CVE-2019-1130 High · 7.8 KEV High · 63 Ransomware CWE-59 Jul 15, 2019

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.

CVE-2019-1129 High · 7.8 KEV High · 63 Ransomware CWE-59 Jul 15, 2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

CVE-2019-1064 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-59 Jun 12, 2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.

CVE-2019-1069 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-59 Jun 12, 2019

Microsoft Task Scheduler Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

CVE-2019-0841 High · 7.8 KEV Urgent · 86 Public exploit Ransomware CWE-59 Apr 9, 2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

CVE-2017-12172 Medium · 6.7 CWE-59 Nov 22, 2017

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x...

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

CVE-2015-5287 High · 7.8 KEV Urgent · 75 Public exploit CWE-59 Dec 7, 2015

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVE-2015-1130 High · 7.8 KEV Urgent · 75 Public exploit CWE-59 Apr 10, 2015

Apple OS X Authentication Bypass Vulnerability

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.