CWE-22 · Path Traversal (page 33)
Page 33 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20529 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20528 | Low | 3.8 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system… |
CVE-2024-20527 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-47464 | Medium | 6.8 | 2024-11-05 | An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbi… |
CVE-2024-51756 | | 2024-11-05 | The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code. cap-std's filesys… | |
CVE-2024-47253 | High | 7.2 | 2024-11-05 | In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to write files on the… |
CVE-2024-51127 | High | 7.1 | 2024-11-04 | An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. |
CVE-2024-51582 | High | 7.5 | 2024-11-04 | Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: f… |
CVE-2024-10389 | High | 7.5 | 2024-11-04 | There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrar… |
CVE-2024-51483 | | 2024-11-01 | changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///e… | |
CVE-2024-49770 | | 2024-11-01 | `oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow… | |
CVE-2024-37423 | High | 8.5 | 2024-11-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue aff… |
CVE-2024-37108 | High | 7.7 | 2024-11-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This… |
CVE-2024-39722 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route. |
CVE-2024-39332 | Critical | 9.8 | 2024-10-31 | Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modificati… |
CVE-2024-10005 | High | 8.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-bas… |
CVE-2024-48735 | High | 7.7 | 2024-10-30 | Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by ma… |
CVE-2024-50509 | High | 8.6 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-50508 | High | 7.5 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-7962 | High | 7.5 | 2024-10-29 | An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. A… |
CVE-2024-7774 | Critical | 9.1 | 2024-10-29 | A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files… |
CVE-2024-5982 | Critical | 9.8 | 2024-10-29 | A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple… |
CVE-2024-44255 | High | 7.8 | 2024-10-28 | A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventur… |
CVE-2024-50453 | High | 7.5 | 2024-10-28 | Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elemento… |
CVE-2024-49771 | Medium | 5.3 | 2024-10-28 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-202… |
CVE-2024-48224 | Medium | 4.9 | 2024-10-25 | Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile. |
CVE-2024-49766 | Medium | 5.3 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share… |
CVE-2024-37847 | High | 8.8 | 2024-10-25 | An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a crafted file. |
CVE-2024-49381 | High | 7.5 | 2024-10-25 | Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitra… |
CVE-2024-10379 | Medium | 4.3 | 2024-10-25 | A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function actionViewDecyptFile of the file /com/esa… |
CVE-2024-47027 | High | 7.8 | 2024-10-25 | In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to… |
CVE-2024-45842 | Medium | 5.3 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retr… |
CVE-2024-10011 | High | 8.1 | 2024-10-25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possi… |
CVE-2024-49760 | High | 7.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of t… |
CVE-2024-49359 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-48931 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint… |
CVE-2024-47883 | Critical | 9.1 | 2024-10-24 | The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer t… |
CVE-2024-45262 | High | 8.8 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the… |
CVE-2024-10313 | High | 8.0 | 2024-10-24 | iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constr… |
CVE-2024-48213 | Medium | 4.3 | 2024-10-23 | RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. |
CVE-2024-20379 | Medium | 6.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-41717 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system. |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2024-41713 | Critical | 9.1 | 2024-10-21 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to c… |
CVE-2024-49366 | High | 7.5 | 2024-10-21 | Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can… |
CVE-2024-45309 | High | 7.5 | 2024-10-21 | OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files acces… |
CVE-2024-47742 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are c… |
CVE-2024-10200 | High | 7.5 | 2024-10-21 | Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to… |
CVE-2024-49286 | Critical | 9.6 | 2024-10-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inc… |
CVE-2024-10100 | High | 7.5 | 2024-10-17 | A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is… |
CVE-2024-49287 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltu… |
CVE-2024-49285 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local Fi… |
CVE-2024-49315 | High | 8.6 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Pa… |
CVE-2024-46212 | Medium | 4.9 | 2024-10-16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal. |
CVE-2024-49245 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue… |
CVE-2024-47645 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows P… |
CVE-2024-47637 | High | 8.8 | 2024-10-16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from… |
CVE-2024-47351 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.T… |
CVE-2024-45711 | High | 7.5 | 2024-10-16 | SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authentic… |
CVE-2020-36836 | High | 8.0 | 2024-10-16 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capa… |
CVE-2019-25213 | Critical | 9.8 | 2024-10-16 | The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insuffic… |
CVE-2024-9676 | Medium | 6.5 | 2024-10-15 | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI… |
CVE-2024-48914 | Critical | 9.1 | 2024-10-15 | Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to… |
CVE-2024-9983 | High | 7.5 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabil… |
CVE-2024-46898 | High | 7.5 | 2024-10-15 | SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitra… |
CVE-2024-0129 | Medium | 6.3 | 2024-10-15 | NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exp… |
CVE-2024-45731 | High | 8.0 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could wri… |
CVE-2024-9047 | Critical | 9.8 | 2024-10-12 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This… |
CVE-2024-47877 | High | 7.5 | 2024-10-11 | Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside… |
CVE-2024-7514 | Medium | 6.5 | 2024-10-11 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comment… |
CVE-2024-6971 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_databas… |
CVE-2024-47868 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which… |
CVE-2024-47166 | Medium | 5.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_compone… |
CVE-2024-47164 | Medium | 6.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `… |
CVE-2024-9675 | High | 7.8 | 2024-10-09 | A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a… |
CVE-2024-9575 | | 2024-10-09 | Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget… | |
CVE-2024-47191 | High | 7.1 | 2024-10-09 | pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishand… |
CVE-2024-36814 | Medium | 4.9 | 2024-10-08 | An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operat… |
CVE-2024-9381 | High | 7.2 | 2024-10-08 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. |
CVE-2024-47011 | High | 7.5 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information |
CVE-2024-47010 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47009 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47563 | Medium | 5.3 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate a file path that is… |
CVE-2024-47818 | Medium | 6.5 | 2024-10-07 | Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by ca… |
CVE-2024-45291 | Medium | 6.3 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from… |
CVE-2024-47559 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47558 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47557 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-47556 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-46446 | Critical | 9.8 | 2024-10-07 | Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passe… |
CVE-2024-47309 | Medium | 6.6 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-… |
CVE-2024-44034 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Martin Greenwood WPSPX wpspx allows PHP Local File Inclusion.Th… |
CVE-2024-44018 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Website… |
CVE-2024-9146 | Medium | 4.9 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This… |
CVE-2024-44016 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in amarksteadman Podiant podiant allows PHP Local File Inclusion.T… |
CVE-2024-44015 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File… |
CVE-2024-44014 | Critical | 9.6 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PH… |
CVE-2024-44013 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local… |