# CWE-1386. Every Advisory and CVE whose sources give the weakness CWE-1386, newest first. ## Records, newest first - [Veeam Backup for Microsoft 365: A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM…](https://agentprime.io/advisories/CVE-2025-64394.md) `CVE-2025-64394` · CVE record: Veeam Backup for Microsoft 365 · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-1386 - [Root.Mkdir(All) can follow junctions out of the root on Windows in os](https://agentprime.io/advisories/GO-2026-6604.md) `GO-2026-6604`, `BIT-golang-2026-56857`, `CVE-2026-56857` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1386 - [This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.](https://agentprime.io/advisories/CVE-2025-64391.md) `CVE-2025-64391` · CVE record: Veeam Agent for Windows · CVSS 4.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-1386 - [Dell Inventory Collector Client: Dell Inventory Collector Client, versions prior to 13.8.0…](https://agentprime.io/advisories/CVE-2026-41116.md) `CVE-2026-41116` · CVE record: Dell Inventory Collector Client · CVSS 6.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1386 - [Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store](https://agentprime.io/advisories/CVE-2025-58074.md) `CVE-2025-58074` · CVE record: Gen Digital Norton Secure VPN · CVSS 8.8 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-1386 - [A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure.](https://agentprime.io/advisories/CVE-2024-36340.md) `CVE-2024-36340` · CVE record: AMD AMD μProf · CVSS 6.6 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-1386 - [Local privilege escalation in ESET products for Windows](https://agentprime.io/advisories/CVE-2024-7400.md) `CVE-2024-7400` · CVE record: ESET, spol. s r.o. ESET NOD32 Antivirus and 4 more · CVSS 8.5 High · Not analysed yet · Published 27 Sept 2024 · Tags: CWE-1386 - [Dell DUP Framework: DUP framework version 4.9.4.36 and prior contains insecure operation on Windows…](https://agentprime.io/advisories/CVE-2023-32454.md) `CVE-2023-32454` · CVE record: Dell DUP Framework · CVSS 6.3 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-1386 - [Dell Display Manager: Dell Display Manager application, version 2.1.1.17 and prior…](https://agentprime.io/advisories/CVE-2023-32474.md) `CVE-2023-32474` · CVE record: Dell Dell Display Manager · CVSS 6.6 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-1386 - [HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability](https://agentprime.io/advisories/GHSA-47xw-vw6m-w9fq.md) `GHSA-47xw-vw6m-w9fq`, `CVE-2023-5834` · Go `github.com/hashicorp/vagrant`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2023 · Tags: Path traversal, CWE-1386 - [Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)](https://agentprime.io/advisories/CVE-2023-40623.md) `CVE-2023-40623` · CVE record: SAP_SE SAP BusinessObjects Suite (Installer) · CVSS 6.2 Medium · Not analysed yet · Published 12 Sept 2023 · Tags: CWE-1386 - [Dell Digital Delivery: Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows…](https://agentprime.io/advisories/CVE-2023-32470.md) `CVE-2023-32470` · CVE record: Dell Dell Digital Delivery · CVSS 5.0 Medium · Not analysed yet · Published 8 Sept 2023 · Tags: CWE-1386 - [Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability.](https://agentprime.io/advisories/CVE-2023-28065.md) `CVE-2023-28065` · CVE record: Dell Dell Command Update (DCU) · CVSS 6.7 Medium · Not analysed yet · Published 23 Jun 2023 · Tags: CWE-1386 - [Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability.](https://agentprime.io/advisories/CVE-2023-28071.md) `CVE-2023-28071` · CVE record: Dell Dell Command Update (DCU) · CVSS 6.3 Medium · Not analysed yet · Published 23 Jun 2023 · Tags: CWE-1386 - [Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation.](https://agentprime.io/advisories/CVE-2023-23697.md) `CVE-2023-23697` · CVE record: Dell Dell Command Update (DCU) · CVSS 4.7 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: CWE-1386 - [Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation.](https://agentprime.io/advisories/CVE-2023-24572.md) `CVE-2023-24572` · CVE record: Dell Dell Command Integration Suite for System Center (DCIS) · CVSS 4.7 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: CWE-1386 - [Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component.](https://agentprime.io/advisories/CVE-2023-23698.md) `CVE-2023-23698` · CVE record: Dell Dell Command Update (DCU) · CVSS 5.5 Medium · Not analysed yet · Published 10 Feb 2023 · Tags: CWE-1386 - [NVIDIA GeForce Experience: NVIDIA GeForce Experience contains a vulnerability in the installer…](https://agentprime.io/advisories/CVE-2022-42291.md) `CVE-2022-42291` · CVE record: NVIDIA GeForce Experience · CVSS 8.2 High · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-1386 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .