CWE-22 · Path Traversal (page 36)
Page 36 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41628 | High | 7.5 | 2024-07-26 | Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote… |
CVE-2024-42007 | Medium | 5.8 | 2024-07-26 | SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files. |
CVE-2024-41373 | Medium | 6.3 | 2024-07-26 | ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. |
CVE-2024-7080 | Medium | 5.3 | 2024-07-24 | A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-40422 | Critical | 9.1 | 2024-07-24 | The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipul… |
CVE-2024-6885 | High | 8.1 | 2024-07-23 | The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2024-6791 | High | 7.8 | 2024-07-22 | A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation… |
CVE-2024-40051 | High | 7.5 | 2024-07-22 | IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter. |
CVE-2024-28698 | Critical | 9.8 | 2024-07-22 | Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileForm… |
CVE-2020-24102 | High | 7.6 | 2024-07-22 | Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code. |
CVE-2024-39688 | Medium | 6.5 | 2024-07-22 | Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new… |
CVE-2024-41704 | Critical | 9.8 | 2024-07-22 | LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. |
CVE-2024-6949 | Medium | 4.3 | 2024-07-21 | A vulnerability classified as problematic was found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected by this vulnerability is an unknown… |
CVE-2024-6281 | High | 7.3 | 2024-07-20 | A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequa… |
CVE-2024-40348 | High | 8.2 | 2024-07-20 | An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. |
CVE-2024-3934 | Medium | 6.5 | 2024-07-20 | The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog functi… |
CVE-2024-40629 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-40628 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-6164 | Critical | 9.8 | 2024-07-18 | The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenti… |
CVE-2024-28993 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-28992 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23475 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23474 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability. |
CVE-2024-23472 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read… |
CVE-2024-23468 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23467 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23466 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability. If exploited, this vulnerability allows an… |
CVE-2024-40617 | Medium | 6.5 | 2024-07-17 | Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a… |
CVE-2024-39036 | Medium | 6.5 | 2024-07-16 | SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. |
CVE-2024-5852 | Medium | 4.3 | 2024-07-16 | The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter… |
CVE-2024-40524 | Critical | 9.8 | 2024-07-15 | Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py component. |
CVE-2024-39918 | Medium | 4.3 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-39826 | Medium | 6.8 | 2024-07-15 | Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network acc… |
CVE-2024-6746 | Medium | 4.3 | 2024-07-15 | A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-39741 | Medium | 4.3 | 2024-07-15 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the system. An attacker could send a speci… |
CVE-2024-31947 | Medium | 6.5 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by authenticated users. Using a crafted path parameter with the Online H… |
CVE-2024-40550 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary… |
CVE-2024-38717 | High | 7.1 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue af… |
CVE-2024-38716 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File I… |
CVE-2024-39903 | High | 8.6 | 2024-07-12 | Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara… |
CVE-2024-38715 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExS ExS Widgets allows PHP Local File Inclusion.This issue affe… |
CVE-2024-38709 | Medium | 5.3 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion… |
CVE-2024-38704 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Incl… |
CVE-2024-37932 | High | 8.6 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in anhvnit Woocommerce OpenPos allows File Manipulation.This issue… |
CVE-2024-37928 | High | 8.6 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects… |
CVE-2024-2602 | High | 7.3 | 2024-07-11 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an… |
CVE-2024-39330 | Medium | 4.3 | 2024-07-10 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they overri… |
CVE-2024-22377 | Medium | 5.3 | 2024-07-09 | The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. |
CVE-2024-39171 | Critical | 9.8 | 2024-07-09 | Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statemen… |
CVE-2024-37513 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPC… |
CVE-2024-37501 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Tr… |
CVE-2024-37499 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vci… |
CVE-2024-37497 | High | 7.7 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetThemeCore jet-theme-core.This issue affects JetTh… |
CVE-2024-37464 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.Th… |
CVE-2024-37462 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path T… |
CVE-2024-37454 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue aff… |
CVE-2024-37437 | Medium | 5.5 | 2024-07-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue… |
CVE-2024-37419 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.Thi… |
CVE-2024-37268 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Str… |
CVE-2024-37266 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tuto… |
CVE-2024-37224 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP… |
CVE-2024-5456 | High | 8.8 | 2024-07-09 | The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. Thi… |
CVE-2024-37547 | Medium | 6.5 | 2024-07-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livem… |
CVE-2024-39178 | Medium | 5.4 | 2024-07-05 | MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid. |
CVE-2024-39937 | High | 8.6 | 2024-07-04 | supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files. |
CVE-2024-2385 | High | 8.8 | 2024-07-04 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via several of the plugin… |
CVE-2024-33870 | Medium | 6.3 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current di… |
CVE-2024-33869 | Medium | 5.3 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of pa… |
CVE-2024-5821 | Medium | 6.2 | 2024-07-03 | The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content… |
CVE-2024-5866 | Medium | 5.0 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary d… |
CVE-2024-5865 | High | 7.7 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files readin… |
CVE-2024-5349 | High | 8.8 | 2024-07-02 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_s… |
CVE-2024-36991 | High | 7.5 | 2024-07-01 | In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splu… |
CVE-2024-24749 | High | 7.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Wi… |
CVE-2023-47803 | Medium | 5.3 | 2024-06-28 | A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings functionality. This… |
CVE-2024-36059 | Critical | 9.4 | 2024-06-27 | Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IE… |
CVE-2024-6127 | Critical | 9.8 | 2024-06-27 | BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit… |
CVE-2024-6090 | High | 7.5 | 2024-06-27 | A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerabili… |
CVE-2024-6085 | High | 8.6 | 2024-06-27 | A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an… |
CVE-2024-5980 | Critical | 9.8 | 2024-06-27 | A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files… |
CVE-2024-5824 | High | 7.4 | 2024-06-27 | A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.y… |
CVE-2024-5548 | High | 7.5 | 2024-06-27 | A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit th… |
CVE-2024-22232 | High | 7.7 | 2024-06-27 | A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt ma… |
CVE-2024-22231 | Medium | 5.0 | 2024-06-27 | Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary direct… |
CVE-2024-5019 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.Cach… |
CVE-2024-5018 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNM… |
CVE-2024-5017 | Medium | 6.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport… |
CVE-2024-4885 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtiliti… |
CVE-2024-4498 | High | 7.7 | 2024-06-25 | A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vuln… |
CVE-2024-32111 | Medium | 5.0 | 2024-06-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue… |
CVE-2024-34313 | Critical | 9.8 | 2024-06-24 | An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. |
CVE-2023-49793 | Medium | 6.5 | 2024-06-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoin… |
CVE-2024-33881 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-33879 | Critical | 9.8 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-37825 | Medium | 5.4 | 2024-06-24 | An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers o… |
CVE-2024-37231 | High | 8.6 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulat… |
CVE-2024-37092 | High | 8.5 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-37089 | Critical | 9.0 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2012-6664 | Critical | 9.1 | 2024-06-21 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary… |