Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2025-21204HIGHWindows Process Activation Elevation of Privilege VulnerabilityEPSS 7.0%CVE-2019-1064HIGHWindows Elevation of Privilege VulnerabilityEPSS 6.9%KEVCVE-2023-36394HIGHWindows Search Service Elevation of Privilege VulnerabilityEPSS 6.7%CVE-2019-1069HIGHTask Scheduler Elevation of Privilege VulnerabilityEPSS 6.1%KEVCVE-2018-10897HIGHA directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configurEPSS 5.7%CVE-2020-5738—Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a sEPSS 5.4%CVE-2015-5287HIGHThe abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privEPSS 5.0%KEVCVE-2025-60710HIGHHost Process for Windows Tasks Elevation of Privilege VulnerabilityEPSS 4.6%KEVCVE-2025-48384HIGHGit allows arbitrary code execution through broken config quotingEPSS 4.1%KEVCVE-2024-20656HIGHVisual Studio Elevation of Privilege VulnerabilityEPSS 3.9%CVE-2019-1188HIGHLNK Remote Code Execution VulnerabilityEPSS 3.8%CVE-2016-9602HIGHQemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use thiEPSS 3.7%CVE-2025-21420HIGHWindows Disk Cleanup Tool Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2026-61358HIGHWindows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege VulnerabilityEPSS 3.7%CVE-2026-45586HIGHWindows Collaborative Translation Framework (CTFMON) Elevation of Privilege VulnerabilityEPSS 3.6%CVE-2019-1385HIGHAn elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiEPSS 3.6%KEVCVE-2019-1315HIGHAn elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error ReportEPSS 3.5%KEVCVE-2026-62832HIGHWindows User Profile Service Elevation of Privilege VulnerabilityEPSS 3.3%CVE-2021-37701HIGHArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksEPSS 3.3%CVE-2018-14651HIGHIt was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, aEPSS 3.2%