CWE-22 · Path Traversal (page 37)
Page 37 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35781 | Medium | 6.5 | 2024-06-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YAHMAN Word Balloon allows PHP Local File Inclusion.This issue… |
CVE-2024-35778 | Medium | 6.5 | 2024-06-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John West Slideshow SE PHP Local File Inclusion.This issue affe… |
CVE-2023-45197 | Critical | 9.8 | 2024-06-21 | The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attack… |
CVE-2024-4098 | Critical | 9.8 | 2024-06-20 | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts fu… |
CVE-2024-5182 | Critical | 9.1 | 2024-06-20 | A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process t… |
CVE-2024-38358 | Low | 2.9 | 2024-06-19 | Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can tra… |
CVE-2024-36117 | High | 8.6 | 2024-06-19 | Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an A… |
CVE-2024-36116 | High | 7.5 | 2024-06-19 | Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDo… |
CVE-2024-37902 | Critical | 10.0 | 2024-06-17 | DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts f… |
CVE-2024-38449 | High | 7.7 | 2024-06-17 | A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote authenticated attacke… |
CVE-2024-36527 | Medium | 6.5 | 2024-06-17 | puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive i… |
CVE-2024-6044 | Medium | 6.5 | 2024-06-17 | Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary syst… |
CVE-2024-24320 | High | 8.8 | 2024-06-14 | Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrar… |
CVE-2024-2024 | High | 8.8 | 2024-06-14 | The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function i… |
CVE-2024-2023 | Medium | 4.3 | 2024-06-14 | The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders… |
CVE-2024-27178 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be execut… |
CVE-2024-27177 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be exe… |
CVE-2024-27176 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be execut… |
CVE-2024-27174 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and diffi… |
CVE-2024-27173 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can… |
CVE-2024-27145 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker c… |
CVE-2024-27144 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the… |
CVE-2023-35860 | Medium | 5.3 | 2024-06-13 | A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the d… |
CVE-2024-34129 | High | 7.5 | 2024-06-13 | Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… |
CVE-2024-4576 | Medium | 5.3 | 2024-06-13 | The component listed above contains a vulnerability that allows an attacker to traverse directories and access sensitive files, leading to unauthorized disclos… |
CVE-2024-37037 | High | 8.1 | 2024-06-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access… |
CVE-2024-5154 | High | 8.1 | 2024-06-12 | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows th… |
CVE-2024-4315 | Critical | 9.1 | 2024-06-12 | parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` functi… |
CVE-2024-37169 | Medium | 5.3 | 2024-06-10 | @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's sc… |
CVE-2024-36418 | High | 8.5 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allow… |
CVE-2024-35754 | High | 7.5 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affect… |
CVE-2024-35745 | High | 7.5 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations allow… |
CVE-2024-35744 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Mani… |
CVE-2024-35743 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulati… |
CVE-2024-35712 | Medium | 4.9 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This… |
CVE-2024-35677 | Critical | 9.0 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This is… |
CVE-2024-35658 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Fu… |
CVE-2024-35474 | Medium | 6.5 | 2024-06-10 | A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in Res… |
CVE-2024-34762 | Critical | 9.9 | 2024-06-10 | Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability i… |
CVE-2024-32703 | High | 7.7 | 2024-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: f… |
CVE-2024-32778 | High | 7.7 | 2024-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery con… |
CVE-2024-5637 | High | 7.5 | 2024-06-07 | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all ver… |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-36795 | Medium | 4.0 | 2024-06-06 | Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecif… |
CVE-2024-5550 | Medium | 5.3 | 2024-06-06 | In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability a… |
CVE-2024-5187 | High | 8.8 | 2024-06-06 | A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequa… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-4320 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@rou… |
CVE-2024-3429 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions i… |
CVE-2024-3322 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vuln… |
CVE-2024-3234 | Critical | 9.8 | 2024-06-06 | The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed… |
CVE-2024-2928 | High | 7.5 | 2024-06-06 | A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerabilit… |
CVE-2024-2624 | Critical | 9.8 | 2024-06-06 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_persona… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |
CVE-2024-2360 | Critical | 9.8 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in… |
CVE-2024-23793 | Medium | 6.3 | 2024-06-06 | The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to… |
CVE-2024-1873 | Critical | 9.1 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpo… |
CVE-2024-0520 | High | 8.8 | 2024-06-06 | A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Comm… |
CVE-2024-5505 | High | 8.8 | 2024-06-06 | NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-4941 | High | 7.5 | 2024-06-06 | A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in… |
CVE-2024-2914 | High | 8.8 | 2024-06-06 | A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manip… |
CVE-2024-34832 | Critical | 9.8 | 2024-06-06 | Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node pa… |
CVE-2024-28995 | High | 8.6 | 2024-06-06 | SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. |
CVE-2024-5153 | Critical | 9.1 | 2024-06-06 | The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' p… |
CVE-2024-5179 | High | 8.8 | 2024-06-06 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'item_style' an… |
CVE-2024-35634 | Medium | 4.9 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce – Recent Purchases allows PHP Local Fil… |
CVE-2024-34554 | High | 8.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.Th… |
CVE-2024-34552 | High | 8.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This is… |
CVE-2024-34551 | Critical | 9.0 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This is… |
CVE-2024-34384 | Medium | 6.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File In… |
CVE-2024-33628 | High | 8.8 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclusion.This issue affe… |
CVE-2024-33568 | High | 8.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro al… |
CVE-2024-33560 | Critical | 9.0 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affect… |
CVE-2024-33557 | High | 8.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue a… |
CVE-2024-33541 | Medium | 6.5 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BetterAddons Better Elementor Addons allows PHP Local File Incl… |
CVE-2024-36104 | Critical | 9.1 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14… |
CVE-2024-27776 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE |
CVE-2024-37032 | High | 8.8 | 2024-05-31 | Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPa… |
CVE-2024-35429 | Medium | 6.5 | 2024-05-30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. |
CVE-2024-35428 | High | 7.1 | 2024-05-30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can le… |
CVE-2024-36267 | High | 8.1 | 2024-05-30 | Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete a… |
CVE-2024-36427 | High | 8.1 | 2024-05-29 | The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to se… |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-5433 | | 2024-05-28 | The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression… | |
CVE-2024-34854 | Critical | 9.8 | 2024-05-28 | F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.` |
CVE-2024-35324 | Critical | 9.8 | 2024-05-28 | Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php. |
CVE-2024-32944 | Low | 3.3 | 2024-05-28 | Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip fi… |
CVE-2024-28880 | Medium | 6.5 | 2024-05-28 | Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitive information of… |
CVE-2024-35219 | High | 8.3 | 2024-05-27 | OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec… |
CVE-2024-5353 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handle… |
CVE-2024-36079 | Medium | 6.5 | 2024-05-24 | An issue was discovered in Vaultize 21.07.27. When uploading files, there is no check that the filename parameter is correct. As a result, a temporary file wil… |
CVE-2024-5273 | Medium | 4.3 | 2024-05-24 | Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item… |
CVE-2024-35081 | High | 7.5 | 2024-05-23 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method. |
CVE-2024-34060 | High | 8.8 | 2024-05-23 | IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iri… |
CVE-2024-4347 | High | 7.2 | 2024-05-23 | The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function… |
CVE-2024-5147 | Critical | 9.8 | 2024-05-22 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 vi… |
CVE-2024-35162 | Medium | 6.5 | 2024-05-22 | Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authent… |
CVE-2024-31394 | Medium | 6.5 | 2024-05-22 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x… |
CVE-2024-5040 | High | 7.8 | 2024-05-21 | There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory. |