1271 matches found
CVE-2025-21420_POC
Diffing cleanmgr.exe The new version of cleanmgr.exe includes a call to the SetProcessMitigationPolicy function. With MitigationPolicy set to 16, corresponding to ProcessRedirectionTrustPolicy. Combined with Microsoft's description of CWE-59: Improper Link Resolution Before File Access 'Link...
CVE-2024-21111
CVE-2024-21111 Oracle VirtualBox Prior to 7.0.16 is vulnerable to Local Privilege Escalation via Symbolic Link Following leading to Arbitrary File Delete and Arbitrary File Move. VirtualBox attempts to move log files as NT AUTHORITY\SYSTEM in C:\ProgramData\VirtualBox which all users can write to...
CVE-2026-0827
CVE-2026-0827 The LdeApi.Server.exe process attempts to write MP27AM7Westimation.json to C:\ProgramData\Lenovo\LDE\SYSTEM without impersonation. This directory does not exist by default. Since C:\ProgramData\ allows standard users to create subdirectories, a low-privileged user can create this pa...
CVE-2026-41091-PoC-Exploit
CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Toolkit Legal Disclaimer & Responsible Use This tool is provided for educational and authorized penetration testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by this software...
CVE-2026-41091
🛡️ CVE-2026-41091 - RedSun Microsoft Defender Elevation of Privilege Vulnerability RedSun is a local privilege escalation LPE technique and associated PoC abusing a link-following vulnerability in Microsoft Defender's Malware Protection Engine. It allows a low-privileged authenticated attacker to...
CVE-2025-48384-poc
CVE-2025-48384-poc CVE-2025-48384 takes the form of an improper link resolution link following vulnerability in git. Specifically, filenames with carriage returns are improperly parsed in .git/config, and including a symlink to point a git hook executable located in a submodule as the submodule...
CVE-2025-47181
CVE-2025-47181 Concept: Microsoft Edge Link Following Privilege Escalation Project Overview This repository presents the CVE-2025-47181 Concept , a Python program designed to illustrate the mechanism and impact of CVE-2025-47181. This is a Privilege Escalation vulnerability in Microsoft Edge...
CVE-2026-126859
A link following flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/563340397...
CVE-2026-126859
Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-126644
A link-following flaw was found in the authorizedkey module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component os.chown with followsymlinks=False and ONOFOLLOW in safeopenwrite. When an unprivileged local user replaces their /.ss...
EUVD-2026-124343
A link-following flaw was found in the authorizedkey module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component os.chown with followsymlinks=False and ONOFOLLOW in safeopenwrite. When an unprivileged local user replaces their /.ss...
CVE-2026-126644 Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory
A link-following flaw was found in the authorizedkey module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component os.chown with followsymlinks=False and ONOFOLLOW in safeopenwrite. When an unprivileged local user replaces their /.ss...
CVE-2026-126644
A link-following flaw exists in the authorized_key module of the ansible.posix collection. This vulnerability is residual to the fix for CVE-2026-11837 because the existing fix only guards the final path component. An unprivileged local user can replace their ~/.ssh directory with a symlink to a ...
Linux Distros Unpatched Vulnerability : CVE-2026-126644
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link-following flaw was found in the authorizedkey module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the...
CVE-2026-126612
Progressive Robot hMailServer versions 6.0.0 through 6.3.7 are vulnerable to Improper Link Resolution Before File Access (CWE-59) in the Windows installer. A local authenticated user can execute arbitrary code as the mail server's service account (LocalSystem or virtual account) or as an administ...
CVE-2026-126612 Improper Link Resolution Before File Access ('Link Following') in hMailServer
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a moun...
CVE-2026-95963
Improper link resolution before file access 'link following' in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...
CVE-2026-88224
Improper link resolution before file access 'link following' in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally...