CWE-22 · Path Traversal (page 32)
Page 32 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49360 | Critical | 9.2 | 2024-11-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges… |
CVE-2024-11992 | Critical | 9.1 | 2024-11-29 | Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and dow… |
CVE-2024-11481 | High | 8.2 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwa… |
CVE-2024-52481 | High | 7.5 | 2024-11-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This is… |
CVE-2024-9669 | High | 7.2 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_l… |
CVE-2024-46939 | | 2024-11-28 | The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, wh… | |
CVE-2024-54004 | Medium | 4.3 | 2024-11-27 | Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with… |
CVE-2024-11667 | High | 7.5 | 2024-11-27 | A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware version… |
CVE-2024-11219 | Medium | 5.3 | 2024-11-27 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and in… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-53844 | Medium | 6.3 | 2024-11-26 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export funct… |
CVE-2024-33605 | High | 7.5 | 2024-11-26 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, mo… |
CVE-2024-52787 | Critical | 9.1 | 2024-11-25 | An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file. |
CVE-2024-11664 | High | 8.8 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file e… |
CVE-2024-10803 | High | 7.5 | 2024-11-23 | The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file… |
CVE-2024-7565 | High | 7.8 | 2024-11-22 | SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5581 | High | 7.2 | 2024-11-22 | Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2023-52334 | Medium | 6.5 | 2024-11-22 | Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2023-52333 | High | 7.3 | 2024-11-22 | Allegra saveFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2023-52332 | High | 7.5 | 2024-11-22 | Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inform… |
CVE-2023-51648 | Medium | 6.5 | 2024-11-22 | Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2023-51647 | Medium | 4.7 | 2024-11-22 | Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2023-51646 | Medium | 4.7 | 2024-11-22 | Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2023-51645 | Medium | 4.7 | 2024-11-22 | Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2023-51643 | Medium | 4.7 | 2024-11-22 | Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2023-51640 | Medium | 4.7 | 2024-11-22 | Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2023-51639 | Critical | 9.8 | 2024-11-22 | Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2024-10220 | High | 8.1 | 2024-11-22 | The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.2… |
CVE-2024-37046 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-37043 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-52056 | Medium | 6.5 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the ta… |
CVE-2024-52055 | Medium | 4.9 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target di… |
CVE-2024-52054 | Low | 2.7 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the fil… |
CVE-2024-52771 | Critical | 9.1 | 2024-11-20 | DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view. |
CVE-2024-52449 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This… |
CVE-2024-52448 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified… |
CVE-2024-52444 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2024-52600 | Medium | 5.3 | 2024-11-19 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may resul… |
CVE-2024-48071 | Medium | 6.5 | 2024-11-19 | E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently… |
CVE-2024-47820 | Medium | 5.7 | 2024-11-18 | MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated inst… |
CVE-2021-1465 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory tra… |
CVE-2020-3538 | Medium | 4.6 | 2024-11-18 | A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perfo… |
CVE-2020-26071 | High | 8.4 | 2024-11-18 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected dev… |
CVE-2024-11303 | | 2024-11-18 | The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects… | |
CVE-2024-41971 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss. |
CVE-2024-11315 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11314 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11313 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11312 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11311 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11310 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11309 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-9935 | High | 7.5 | 2024-11-16 | The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw… |
CVE-2024-44625 | High | 8.8 | 2024-11-15 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go. |
CVE-2024-50649 | Critical | 9.8 | 2024-11-15 | The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. |
CVE-2024-50648 | Critical | 9.8 | 2024-11-15 | yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files. |
CVE-2024-41784 | High | 7.5 | 2024-11-15 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker coul… |
CVE-2024-11239 | Medium | 5.4 | 2024-11-15 | A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common… |
CVE-2024-11238 | Medium | 6.5 | 2024-11-15 | A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_com… |
CVE-2024-42499 | Medium | 5.3 | 2024-11-15 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is ex… |
CVE-2024-52396 | Medium | 4.9 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2024-52378 | High | 7.5 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This is… |
CVE-2024-52371 | High | 8.6 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4… |
CVE-2024-11210 | Medium | 5.4 | 2024-11-14 | A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/Filemana… |
CVE-2024-50843 | Medium | 5.3 | 2024-11-14 | A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access se… |
CVE-2024-11215 | Medium | 6.5 | 2024-11-14 | Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulne… |
CVE-2024-47916 | High | 7.5 | 2024-11-14 | Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-45253 | High | 7.5 | 2024-11-14 | Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-21799 | High | 7.1 | 2024-11-13 | Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2024-52292 | High | 7.7 | 2024-11-13 | Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This f… |
CVE-2024-52291 | High | 8.4 | 2024-11-13 | Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file://… |
CVE-2024-52293 | High | 7.2 | 2024-11-13 | Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Re… |
CVE-2024-48510 | Critical | 9.8 | 2024-11-13 | Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.c… |
CVE-2024-11150 | Critical | 9.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_upload… |
CVE-2024-10816 | High | 7.5 | 2024-11-13 | The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file… |
CVE-2024-34787 | High | 7.8 | 2024-11-13 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-35274 | Low | 2.3 | 2024-11-12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortin… |
CVE-2024-32117 | Medium | 4.9 | 2024-11-12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 a… |
CVE-2024-32116 | Medium | 5.1 | 2024-11-12 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 th… |
CVE-2024-50336 | | 2024-11-12 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via cra… | |
CVE-2024-50329 | High | 8.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to… |
CVE-2024-50324 | High | 7.2 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50322 | High | 7.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-50559 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-46888 | Critical | 9.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths fo… |
CVE-2024-11123 | Medium | 4.3 | 2024-11-12 | A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/… |
CVE-2024-10672 | Low | 2.7 | 2024-11-12 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upse… |
CVE-2024-51748 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in com… |
CVE-2024-51747 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the se… |
CVE-2024-46954 | High | 7.8 | 2024-11-10 | An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory travers… |
CVE-2024-10470 | Critical | 9.8 | 2024-11-09 | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient fil… |
CVE-2024-10626 | High | 8.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uplo… |
CVE-2024-10625 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_… |
CVE-2024-51998 | High | 8.6 | 2024-11-08 | changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being a… |
CVE-2024-43440 | High | 7.5 | 2024-11-07 | A flaw was found in moodle. A local file may include risks when restoring block backups. |
CVE-2024-43434 | High | 8.1 | 2024-11-07 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. |
CVE-2024-51990 | | 2024-11-07 | jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clon… | |
CVE-2024-51751 | Medium | 6.5 | 2024-11-06 | Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of… |
CVE-2024-20532 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |