CWE-22 · Path Traversal (page 39)
Page 39 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32164 | High | 7.5 | 2024-05-03 | D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2023-32137 | Medium | 6.5 | 2024-05-03 | D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to discl… |
CVE-2023-27326 | High | 8.2 | 2024-05-03 | Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2024-34033 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended di… |
CVE-2024-3107 | Medium | 4.3 | 2024-05-02 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_defaul… |
CVE-2024-31965 | Medium | 4.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-33274 | High | 7.5 | 2024-04-30 | Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information via the Custom Checko… |
CVE-2023-45385 | High | 7.5 | 2024-04-30 | ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module. |
CVE-2024-23774 | High | 7.8 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe an… |
CVE-2024-23773 | High | 7.8 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component… |
CVE-2024-23772 | Medium | 6.6 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedulerSvc.exe, KUserAle… |
CVE-2024-33350 | Critical | 9.8 | 2024-04-29 | Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/f… |
CVE-2024-31801 | High | 7.5 | 2024-04-29 | Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2024-3195 | Medium | 4.7 | 2024-04-29 | A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. T… |
CVE-2024-4297 | Medium | 4.9 | 2024-04-29 | The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain funct… |
CVE-2024-4296 | Medium | 4.9 | 2024-04-29 | The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain functio… |
CVE-2024-3034 | Low | 2.7 | 2024-04-27 | The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse paramet… |
CVE-2023-51365 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-51364 | High | 8.7 | 2024-04-26 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-47222 | Critical | 9.6 | 2024-04-26 | An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to com… |
CVE-2023-41291 | Medium | 5.5 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2023-41290 | Medium | 4.1 | 2024-04-26 | A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the con… |
CVE-2024-2434 | High | 8.5 | 2024-04-25 | An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where p… |
CVE-2022-45852 | Medium | 6.5 | 2024-04-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Trave… |
CVE-2024-28977 | Low | 3.3 | 2024-04-24 | Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could pote… |
CVE-2024-28976 | High | 8.8 | 2024-04-24 | Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially… |
CVE-2024-32869 | Medium | 5.3 | 2024-04-23 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible… |
CVE-2024-32258 | High | 8.8 | 2024-04-23 | The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake RO… |
CVE-2024-32399 | High | 7.6 | 2024-04-22 | Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ co… |
CVE-2024-31450 | Low | 2.7 | 2024-04-19 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API a… |
CVE-2024-31552 | High | 7.1 | 2024-04-19 | CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sens… |
CVE-2024-31587 | Medium | 6.5 | 2024-04-19 | SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request. |
CVE-2024-27984 | High | 7.1 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or… |
CVE-2024-27977 | High | 8.1 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby lead… |
CVE-2024-27976 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-25000 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24999 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24997 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24994 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24992 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. |
CVE-2024-23535 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2023-50885 | Medium | 6.8 | 2024-04-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Loc… |
CVE-2023-47843 | High | 7.6 | 2024-04-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a th… |
CVE-2023-3675 | Medium | 6.5 | 2024-04-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System R… |
CVE-2024-32163 | Medium | 6.4 | 2024-04-17 | CMSeasy 7.7.7.9 is vulnerable to code execution. |
CVE-2024-28073 | High | 8.4 | 2024-04-17 | SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be… |
CVE-2024-1132 | High | 8.1 | 2024-04-17 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious requ… |
CVE-2024-32024 | Medium | 6.5 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `add_pre_postfix` function. This vul… |
CVE-2024-32023 | Medium | 6.5 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `find_and_replace` function. This vu… |
CVE-2024-31451 | Medium | 5.3 | 2024-04-16 | DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1. |
CVE-2024-3573 | Critical | 9.3 | 2024-04-16 | mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the… |
CVE-2024-3571 | High | 8.8 | 2024-04-16 | langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileSt… |
CVE-2024-1961 | High | 8.8 | 2024-04-16 | vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers c… |
CVE-2024-1594 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an e… |
CVE-2024-1593 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using t… |
CVE-2024-1560 | High | 8.1 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path valid… |
CVE-2024-1558 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper va… |
CVE-2024-1483 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP… |
CVE-2023-38511 | Medium | 5.0 | 2024-04-15 | iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnera… |
CVE-2024-3783 | High | 7.7 | 2024-04-15 | The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the… |
CVE-2023-52144 | Medium | 5.5 | 2024-04-15 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed M… |
CVE-2024-3737 | Medium | 6.3 | 2024-04-13 | A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountByQuery of the file… |
CVE-2024-31462 | Medium | 6.3 | 2024-04-12 | stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file… |
CVE-2024-32005 | High | 8.2 | 2024-04-12 | NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under th… |
CVE-2024-3686 | Medium | 4.3 | 2024-04-12 | A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file up… |
CVE-2024-31818 | Critical | 9.8 | 2024-04-12 | Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component. |
CVE-2024-29502 | Medium | 6.5 | 2024-04-10 | An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths. |
CVE-2024-2221 | Critical | 9.8 | 2024-04-10 | qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specific… |
CVE-2024-1728 | High | 7.5 | 2024-04-10 | gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attack… |
CVE-2024-1511 | Critical | 9.8 | 2024-04-10 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allow… |
CVE-2024-31287 | Medium | 6.5 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Libr… |
CVE-2024-31240 | High | 7.7 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from… |
CVE-2024-2654 | Medium | 6.8 | 2024-04-09 | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Thi… |
CVE-2024-1974 | High | 8.8 | 2024-04-09 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the rende… |
CVE-2024-1790 | Medium | 4.9 | 2024-04-09 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type'… |
CVE-2024-31457 | High | 7.7 | 2024-04-09 | gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20… |
CVE-2024-29053 | High | 8.8 | 2024-04-09 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2024-31487 | Medium | 5.9 | 2024-04-09 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1… |
CVE-2024-23671 | High | 8.1 | 2024-04-09 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1… |
CVE-2023-47541 | Medium | 6.7 | 2024-04-09 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2… |
CVE-2024-2224 | High | 8.1 | 2024-04-09 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an… |
CVE-2024-31978 | High | 7.6 | 2024-04-09 | A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2). Affected devices allow authenticated users to export monitoring data. The correspon… |
CVE-2024-31860 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the fi… |
CVE-2023-52544 | Medium | 4.3 | 2024-04-08 | Vulnerability of file path verification being bypassed in the email module. Impact: Successful exploitation of this vulnerability may affect service confidenti… |
CVE-2024-30417 | High | 7.5 | 2024-04-07 | Path traversal vulnerability in the Bluetooth-based sharing module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-0406 | Medium | 6.1 | 2024-04-06 | A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow acces… |
CVE-2024-22328 | High | 7.5 | 2024-04-06 | IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL… |
CVE-2024-31851 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthen… |
CVE-2024-31850 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthent… |
CVE-2024-31849 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unaut… |
CVE-2024-31848 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an un… |
CVE-2024-31220 | High | 7.3 | 2024-04-05 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbi… |
CVE-2024-29672 | High | 8.8 | 2024-04-05 | Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in K… |
CVE-2024-3311 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of… |
CVE-2024-30270 | Medium | 6.2 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30254 | Medium | 5.8 | 2024-04-04 | MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files i… |
CVE-2024-25693 | Critical | 9.9 | 2024-04-04 | There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file… |
CVE-2024-27575 | High | 7.5 | 2024-04-04 | INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/di… |
CVE-2024-23540 | Medium | 5.3 | 2024-04-03 | The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The Big… |
CVE-2024-20352 | Medium | 4.9 | 2024-04-03 | A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attac… |