CVE-2026-15788: Improper Link Resolution Before File Access

BuildKit's cache mount source= selector on Windows Container on Windows WCOW workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon...

EUVD-2021-13521

Malware in sbrugna...

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

PYSEC-2023-292

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

Design/Logic Flaw

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

CVE-2021-26734

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

CVE-2021-26734

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

CVE-2021-26734 Junction Delete leading to elevation of privilege

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

CVE-2021-26734

Affected software: Zscaler Client Connector Installer on Windows

CVE-2021-26734: Improper Privilege Management

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

PT-2023-12107 · Zscaler · Zscaler Client Connector Installer

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector Installer on Windows versions prior to 3.4.0.124 Description: The issue arises from the improper handling of directory junctions during the uninstallation process of the Zscaler Client Connector Installer on Windows...

SUSE CVE-2015-7829

Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete...

PT-2022-21828

Name of the Vulnerable Software and Affected Versions Samsung USB Driver Windows Installer for Mobile Phones versions prior to 1.7.56.0 Description The issue is related to improper validation of integrity checks, allowing local attackers to delete arbitrary directories using directory junctions...

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

Path traversal

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

CVE-2020-14418

CVE-2020-14418 refers to a TOCTOU vulnerability in the library/middleware product madCodeHook before 2020-07-16, enabling local attackers to escalate to SYSTEM via path redirection (directory junctions). The issue is a local privilege escalation with an impact on confidentiality, integrity, and a...

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

CVE-2020-14418: Time-of-check Time-of-use (TOCTOU) Race Condition

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

PT-2021-9726

Name of the Vulnerable Software and Affected Versions madCodeHook versions prior to 2020-07-16 Description A TOCTOU vulnerability exists that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

Acronis: Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)

Issue class description Arbitrary file creation is a vulnerability that allows attacker to create file in arbitrary location within filesystem. This includes protected directories, such as C:\Windows, C:\windows\system32 and "C:\Program Files". If in addition, attacker has control over the file...