CWE-22 · Path Traversal (page 34)
Page 34 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44012 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription a… |
CVE-2024-44011 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin… |
CVE-2024-47841 | High | 7.5 | 2024-10-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path… |
CVE-2024-41511 | Low | 3.9 | 2024-10-04 | A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitra… |
CVE-2024-47769 | High | 7.5 | 2024-10-04 | IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is id… |
CVE-2024-41922 | High | 7.5 | 2024-10-03 | A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a… |
CVE-2024-41163 | High | 7.5 | 2024-10-03 | A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure… |
CVE-2024-9100 | Medium | 6.5 | 2024-10-03 | Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal. |
CVE-2024-8352 | High | 7.5 | 2024-10-03 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i… |
CVE-2024-46977 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside o… |
CVE-2024-24122 | Low | 3.3 | 2024-10-02 | A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip… |
CVE-2024-20449 | High | 8.8 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code o… |
CVE-2024-44030 | High | 7.2 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Ab… |
CVE-2024-44017 | High | 7.5 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion… |
CVE-2024-47071 | Medium | 6.8 | 2024-10-01 | OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to… |
CVE-2024-25659 | High | 7.2 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote at… |
CVE-2024-9224 | Medium | 6.5 | 2024-10-01 | The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world_lyric() function… |
CVE-2024-33369 | High | 8.8 | 2024-09-27 | Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection… |
CVE-2024-9301 | High | 7.5 | 2024-09-27 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a |
CVE-2024-7149 | High | 8.8 | 2024-09-27 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2024-47292 | Medium | 6.2 | 2024-09-27 | Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47171 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-47170 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to re… |
CVE-2024-46327 | Medium | 5.7 | 2024-09-26 | An issue in the Http_handle object of VONETS VAP11G-300 v3.3.23.6.9 allows attackers to access sensitive files via a directory traversal. |
CVE-2024-8704 | High | 7.2 | 2024-09-26 | The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale… |
CVE-2024-44825 | High | 7.5 | 2024-09-25 | Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the… |
CVE-2024-8941 | High | 7.5 | 2024-09-25 | Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthe… |
CVE-2024-8291 | Medium | 4.8 | 2024-09-25 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to… |
CVE-2023-26691 | High | 7.2 | 2024-09-25 | Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on. |
CVE-2023-26687 | High | 8.8 | 2024-09-25 | Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the P… |
CVE-2024-8671 | Critical | 9.1 | 2024-09-24 | The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/b… |
CVE-2024-43996 | Medium | 6.5 | 2024-09-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.Thi… |
CVE-2024-6786 | Medium | 6.5 | 2024-09-21 | The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system… |
CVE-2024-46649 | High | 7.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder. |
CVE-2024-46648 | High | 7.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder. |
CVE-2024-46647 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files. |
CVE-2024-46646 | Medium | 6.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file. |
CVE-2024-46645 | High | 7.5 | 2024-09-20 | eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files. |
CVE-2024-46644 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file. |
CVE-2024-9032 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file… |
CVE-2024-33109 | Critical | 9.9 | 2024-09-19 | Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via t… |
CVE-2024-8963 | Critical | 9.4 | 2024-09-19 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2024-46376 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php. |
CVE-2024-46375 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php. |
CVE-2024-46987 | High | 7.7 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's downlo… |
CVE-2024-46986 | Critical | 9.9 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method… |
CVE-2024-45601 | High | 7.5 | 2024-09-18 | Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially all… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-45604 | Medium | 4.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Us… |
CVE-2024-42501 | High | 7.2 | 2024-09-17 | An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned pac… |
CVE-2021-27916 | High | 8.1 | 2024-09-17 | Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access th… |
CVE-2024-47049 | High | 8.2 | 2024-09-17 | The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, l… |
CVE-2024-44190 | Medium | 5.5 | 2024-09-17 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be abl… |
CVE-2024-44167 | Medium | 5.5 | 2024-09-17 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7… |
CVE-2024-27869 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an… |
CVE-2024-8752 | High | 7.5 | 2024-09-16 | The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system. |
CVE-2024-8778 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arb… |
CVE-2024-8876 | Medium | 4.3 | 2024-09-15 | A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality… |
CVE-2024-8875 | Medium | 5.4 | 2024-09-15 | A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder… |
CVE-2024-8865 | Low | 3.5 | 2024-09-15 | A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\se… |
CVE-2024-8782 | Medium | 6.3 | 2024-09-13 | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The m… |
CVE-2024-38816 | High | 7.5 | 2024-09-13 | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can c… |
CVE-2024-7961 | Critical | 9.8 | 2024-09-12 | A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server t… |
CVE-2024-8707 | Medium | 4.3 | 2024-09-12 | A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function do… |
CVE-2024-8706 | Medium | 4.3 | 2024-09-12 | A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/upda… |
CVE-2024-8694 | Low | 3.8 | 2024-09-11 | A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/updat… |
CVE-2024-7609 | High | 7.5 | 2024-09-11 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal. This issue af… |
CVE-2024-45593 | Critical | 9.0 | 2024-09-10 | Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when u… |
CVE-2024-21753 | Medium | 5.5 | 2024-09-10 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13… |
CVE-2024-44867 | High | 7.5 | 2024-09-10 | phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. |
CVE-2024-37728 | High | 7.5 | 2024-09-10 | Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensit… |
CVE-2024-0067 | Medium | 4.3 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folde… |
CVE-2024-44720 | High | 7.5 | 2024-09-09 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. |
CVE-2024-8585 | Medium | 6.5 | 2024-09-09 | Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privi… |
CVE-2024-40712 | High | 7.8 | 2024-09-07 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). |
CVE-2023-30584 | High | 7.7 | 2024-09-07 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of pat… |
CVE-2024-8538 | Medium | 4.3 | 2024-09-07 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2… |
CVE-2024-21904 | Medium | 5.9 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-51366 | High | 8.7 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2024-6445 | High | 7.5 | 2024-09-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This is… |
CVE-2024-45401 | High | 7.5 | 2024-09-05 | stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3… |
CVE-2024-45175 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive informati… |
CVE-2024-45178 | High | 7.1 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from… |
CVE-2024-45074 | Medium | 6.5 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2024-8410 | Medium | 4.3 | 2024-09-04 | A vulnerability classified as problematic was found in ABCD ABCD2 up to 2.2.0-beta-1. This vulnerability affects unknown code of the file /abcd/opac/php/otros_… |
CVE-2024-8409 | Medium | 4.3 | 2024-09-04 | A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/show_image.php. The… |
CVE-2024-8104 | High | 8.8 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the… |
CVE-2024-34656 | High | 7.3 | 2024-09-04 | Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34653 | Medium | 4.6 | 2024-09-04 | Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege. |
CVE-2024-7950 | Critical | 9.8 | 2024-09-04 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settin… |
CVE-2024-45443 | Medium | 6.1 | 2024-09-04 | Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2024-45388 | High | 7.5 | 2024-09-02 | Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows us… |
CVE-2024-45312 | Medium | 5.3 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vu… |
CVE-2024-43797 | Medium | 6.3 | 2024-09-02 | audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission… |
CVE-2024-42471 | High | 7.3 | 2024-09-02 | actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrar… |
CVE-2024-43957 | Medium | 6.5 | 2024-08-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File I… |
CVE-2024-43955 | Critical | 10.0 | 2024-08-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip… |
CVE-2024-8304 | Medium | 4.7 | 2024-08-29 | A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-45436 | High | 7.5 | 2024-08-29 | extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory. |
CVE-2024-44761 | Critical | 9.8 | 2024-08-28 | An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests. |