CWE-22 · Path Traversal (page 35)
Page 35 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7744 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web T… |
CVE-2023-26321 | Medium | 6.3 | 2024-08-28 | A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special… |
CVE-2024-6312 | Medium | 6.5 | 2024-08-28 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' fu… |
CVE-2024-4556 | Medium | 5.7 | 2024-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive infor… |
CVE-2024-3980 | Critical | 9.9 | 2024-08-27 | The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If e… |
CVE-2024-6789 | Medium | 6.5 | 2024-08-27 | A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated us… |
CVE-2024-8165 | Medium | 4.3 | 2024-08-26 | A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This vulnerability affects the function exportZip of the file /ad… |
CVE-2024-8163 | Medium | 5.4 | 2024-08-26 | A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Affected by this issue is the function destroyFiles of the file /admin… |
CVE-2024-45256 | Critical | 9.8 | 2024-08-26 | An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databases and bypass authen… |
CVE-2024-45241 | High | 7.5 | 2024-08-26 | A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read fil… |
CVE-2024-45189 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request |
CVE-2024-45188 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request |
CVE-2023-7260 | High | 7.5 | 2024-08-22 | Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files o… |
CVE-2024-7634 | Medium | 4.9 | 2024-08-22 | NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secu… |
CVE-2024-6141 | High | 7.8 | 2024-08-21 | Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installat… |
CVE-2024-43022 | High | 7.5 | 2024-08-21 | An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal. |
CVE-2024-7603 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary… |
CVE-2024-7602 | Medium | 6.5 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-7601 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-7600 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files… |
CVE-2024-7782 | High | 8.7 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7777 | Critical | 9.0 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7928 | Medium | 4.3 | 2024-08-19 | A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of… |
CVE-2024-7927 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=… |
CVE-2024-7926 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/about_edit.php?action=modify. The manip… |
CVE-2024-43345 | High | 7.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion… |
CVE-2024-43328 | High | 8.3 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This iss… |
CVE-2024-7924 | Medium | 5.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of… |
CVE-2024-43281 | Medium | 5.3 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page b… |
CVE-2024-43271 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Loc… |
CVE-2024-43248 | High | 8.6 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affec… |
CVE-2024-43232 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider… |
CVE-2024-43221 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This… |
CVE-2024-43399 | High | 8.0 | 2024-08-19 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Befor… |
CVE-2023-5505 | Medium | 6.8 | 2024-08-17 | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows… |
CVE-2024-43395 | High | 8.2 | 2024-08-16 | CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as S… |
CVE-2024-43011 | Medium | 4.9 | 2024-08-16 | An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization… |
CVE-2024-7145 | High | 8.8 | 2024-08-16 | The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This… |
CVE-2024-7146 | High | 8.8 | 2024-08-16 | The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcher_preset' para… |
CVE-2024-7263 | High | 7.8 | 2024-08-15 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an at… |
CVE-2024-7262 | High | 7.8 | 2024-08-15 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an at… |
CVE-2024-43373 | High | 7.7 | 2024-08-15 | webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted… |
CVE-2024-42680 | Medium | 5.5 | 2024-08-15 | An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotatio… |
CVE-2024-27120 | High | 7.5 | 2024-08-14 | A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retr… |
CVE-2024-39406 | Medium | 6.8 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat… |
CVE-2024-39399 | High | 7.7 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat… |
CVE-2024-38652 | Critical | 9.1 | 2024-08-14 | Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary f… |
CVE-2024-7741 | Medium | 5.3 | 2024-08-13 | A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfil… |
CVE-2024-7738 | Low | 3.3 | 2024-08-13 | A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality o… |
CVE-2024-6618 | | 2024-08-13 | In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a maliciou… | |
CVE-2024-43165 | Medium | 6.5 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue a… |
CVE-2024-43140 | High | 7.5 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Lo… |
CVE-2024-43138 | Medium | 6.5 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local… |
CVE-2024-43135 | High | 7.5 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue a… |
CVE-2024-43129 | Medium | 6.5 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This iss… |
CVE-2024-39651 | High | 8.6 | 2024-08-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This is… |
CVE-2024-41938 | Medium | 5.5 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a path… |
CVE-2024-42474 | Medium | 6.5 | 2024-08-12 | Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static fi… |
CVE-2024-42485 | High | 7.5 | 2024-08-12 | Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login… |
CVE-2023-7249 | Critical | 9.8 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This… |
CVE-2024-33535 | High | 7.5 | 2024-08-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application… |
CVE-2024-7693 | High | 7.5 | 2024-08-12 | Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to rea… |
CVE-2024-7399 | High | 8.8 | 2024-08-12 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitr… |
CVE-2024-6759 | Medium | 5.3 | 2024-08-12 | When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdi… |
CVE-2024-42469 | Critical | 9.8 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file… |
CVE-2024-42468 | Medium | 5.3 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4… |
CVE-2024-41936 | High | 7.5 | 2024-08-12 | A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables… |
CVE-2024-21877 | Medium | 6.5 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as E… |
CVE-2024-21876 | Critical | 9.1 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy… |
CVE-2024-0113 | High | 7.5 | 2024-08-12 | NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially… |
CVE-2024-42408 | Medium | 5.3 | 2024-08-08 | The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information expo… |
CVE-2024-6707 | High | 8.8 | 2024-08-07 | Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. |
CVE-2024-7061 | Medium | 5.5 | 2024-08-07 | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To re… |
CVE-2024-37403 | Medium | 5.5 | 2024-08-07 | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting i… |
CVE-2024-7564 | Medium | 6.5 | 2024-08-06 | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-39226 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-7551 | Low | 2.7 | 2024-08-06 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor… |
CVE-2024-5709 | High | 8.8 | 2024-08-06 | The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' paramet… |
CVE-2024-6781 | High | 7.5 | 2024-08-06 | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. |
CVE-2024-23657 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTex… |
CVE-2024-7458 | Medium | 5.5 | 2024-08-04 | A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /ap… |
CVE-2024-41310 | High | 7.5 | 2024-08-02 | AndServer 2.1.12 is vulnerable to Directory Traversal. |
CVE-2024-7323 | Medium | 6.5 | 2024-08-02 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with… |
CVE-2024-38878 | High | 7.2 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (… |
CVE-2024-39624 | High | 8.5 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclus… |
CVE-2024-39621 | High | 8.0 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File… |
CVE-2024-39619 | Critical | 9.0 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File… |
CVE-2024-38772 | Medium | 6.5 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP… |
CVE-2024-38768 | Medium | 4.3 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclus… |
CVE-2024-38746 | High | 7.1 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Pa… |
CVE-2024-7340 | High | 8.8 | 2024-07-31 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak a… |
CVE-2024-37129 | Medium | 6.7 | 2024-07-31 | Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit th… |
CVE-2024-6255 | High | 8.2 | 2024-07-31 | A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including criti… |
CVE-2024-41695 | High | 7.5 | 2024-07-30 | Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory |
CVE-2024-27887 | Medium | 5.5 | 2024-07-29 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data. |
CVE-2024-27871 | Medium | 5.5 | 2024-07-29 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. An app may be able to access… |
CVE-2024-7248 | High | 7.8 | 2024-07-29 | Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2024-41799 | High | 8.4 | 2024-07-29 | tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potenti… |
CVE-2024-41726 | High | 7.5 | 2024-07-29 | Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary executable file may… |
CVE-2024-5882 | High | 7.5 | 2024-07-29 | The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access… |