CWE-22 · Path Traversal (page 41)
Page 41 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35003 | Medium | 6.7 | 2024-02-14 | Path transversal in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via loc… |
CVE-2024-23787 | Medium | 6.5 | 2024-02-14 | Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenti… |
CVE-2024-25125 | Medium | 5.3 | 2024-02-14 | Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload au… |
CVE-2024-1485 | High | 8.0 | 2024-02-14 | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsin… |
CVE-2024-1082 | Medium | 6.3 | 2024-02-13 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying a… |
CVE-2024-1163 | High | 7.1 | 2024-02-13 | The attacker may exploit a path traversal vulnerability leading to information disclosure. |
CVE-2024-23833 | High | 7.5 | 2024-02-12 | OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) whe… |
CVE-2024-22226 | Low | 3.3 | 2024-02-12 | Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploi… |
CVE-2023-6294 | High | 7.2 | 2024-02-12 | The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator rol… |
CVE-2024-1433 | Low | 3.1 | 2024-02-11 | A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlu… |
CVE-2023-40264 | Medium | 4.3 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface. |
CVE-2023-40266 | Critical | 9.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal. |
CVE-2024-24311 | High | 7.5 | 2024-02-07 | Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest… |
CVE-2024-0849 | Medium | 5.0 | 2024-02-07 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. |
CVE-2024-22514 | High | 8.8 | 2024-02-06 | An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file. |
CVE-2024-24591 | High | 8.0 | 2024-02-06 | A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write l… |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2024-23673 | High | 8.5 | 2024-02-06 | Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlet… |
CVE-2024-24398 | Critical | 9.8 | 2024-02-06 | Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted… |
CVE-2024-0964 | Critical | 9.4 | 2024-02-05 | A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. |
CVE-2024-0380 | Medium | 5.4 | 2024-02-05 | The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shor… |
CVE-2024-0221 | Critical | 9.1 | 2024-02-05 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8… |
CVE-2023-6989 | Critical | 9.8 | 2024-02-05 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… |
CVE-2023-7216 | Medium | 5.3 | 2024-02-05 | A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially… |
CVE-2023-52138 | High | 8.2 | 2024-02-05 | Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve… |
CVE-2023-7077 | Critical | 9.8 | 2024-02-05 | Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E90… |
CVE-2021-46902 | High | 7.2 | 2024-02-04 | An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. Path validation is mish… |
CVE-2023-45027 | Medium | 5.5 | 2024-02-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated ad… |
CVE-2023-45026 | Medium | 5.5 | 2024-02-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated ad… |
CVE-2024-0844 | Medium | 4.7 | 2024-02-02 | The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementD… |
CVE-2023-39611 | High | 7.5 | 2024-02-02 | An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web request… |
CVE-2024-22851 | High | 7.5 | 2024-02-02 | Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ e… |
CVE-2021-22281 | Medium | 6.3 | 2024-02-02 | : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: fro… |
CVE-2024-24482 | Critical | 9.8 | 2024-02-02 | Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal. |
CVE-2023-38019 | High | 8.1 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted UR… |
CVE-2024-22779 | High | 8.8 | 2024-02-02 | Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in Ser… |
CVE-2024-22096 | Medium | 6.5 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific com… |
CVE-2024-24756 | High | 7.5 | 2024-02-01 | Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the se… |
CVE-2024-21852 | High | 8.8 | 2024-02-01 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerabilit… |
CVE-2024-24569 | Medium | 5.4 | 2024-02-01 | The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial… |
CVE-2024-23652 | Critical | 10.0 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerf… |
CVE-2023-5390 | Medium | 5.3 | 2024-01-31 | An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. T… |
CVE-2024-24579 | Medium | 5.3 | 2024-01-31 | stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar arc… |
CVE-2024-24565 | Medium | 5.7 | 2024-01-30 | CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the Crat… |
CVE-2024-22523 | High | 7.5 | 2024-01-30 | Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component. |
CVE-2024-23334 | Medium | 5.9 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessa… |
CVE-2023-30970 | Medium | 6.5 | 2024-01-29 | Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file s… |
CVE-2024-23827 | Critical | 9.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check i… |
CVE-2024-23822 | Medium | 5.4 | 2024-01-29 | Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allow… |
CVE-2024-0989 | Medium | 5.4 | 2024-01-29 | A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del… |
CVE-2024-0697 | Medium | 6.5 | 2024-01-27 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the… |
CVE-2024-0402 | Critical | 9.9 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an a… |
CVE-2023-41474 | Medium | 6.5 | 2024-01-25 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.reso… |
CVE-2024-0882 | Medium | 4.3 | 2024-01-25 | A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common… |
CVE-2023-52076 | High | 8.5 | 2024-01-25 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists… |
CVE-2023-50785 | Low | 2.7 | 2024-01-25 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. |
CVE-2024-23904 | High | 7.5 | 2024-01-24 | Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argu… |
CVE-2024-23899 | Medium | 6.5 | 2024-01-24 | Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file p… |
CVE-2024-23897 | Critical | 9.8 | 2024-01-24 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path… |
CVE-2024-22204 | Medium | 5.3 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle a… |
CVE-2024-23182 | High | 8.1 | 2024-01-23 | Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x ser… |
CVE-2024-23340 | Medium | 5.3 | 2024-01-22 | @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `ur… |
CVE-2022-45792 | High | 7.8 | 2024-01-22 | Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting fil… |
CVE-2023-44395 | Medium | 4.9 | 2024-01-22 | Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vuln… |
CVE-2024-23768 | High | 8.8 | 2024-01-22 | Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in these folders) can ac… |
CVE-2024-0769 | Medium | 5.3 | 2024-01-21 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2023-35020 | Medium | 5.4 | 2024-01-19 | IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2023-5097 | High | 7.0 | 2024-01-16 | Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: before 8.7. |
CVE-2023-2252 | Low | 2.7 | 2024-01-16 | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. |
CVE-2021-24566 | High | 8.8 | 2024-01-16 | The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode. |
CVE-2023-6623 | Critical | 9.8 | 2024-01-15 | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over th… |
CVE-2023-46749 | Medium | 6.5 | 2024-01-15 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with pat… |
CVE-2023-48383 | High | 7.5 | 2024-01-15 | NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit thi… |
CVE-2023-52289 | High | 7.5 | 2024-01-13 | An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update… |
CVE-2023-52288 | High | 7.5 | 2024-01-13 | An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resourc… |
CVE-2023-48166 | High | 7.5 | 2024-01-12 | A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attacker to view the cont… |
CVE-2023-49801 | Medium | 4.2 | 2024-01-12 | Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_ban… |
CVE-2010-10011 | Medium | 4.3 | 2024-01-12 | A vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04. Affected is an unknown function. The manipulation leads to pat… |
CVE-2023-31036 | High | 7.5 | 2024-01-12 | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-contr… |
CVE-2023-49569 | Critical | 9.8 | 2024-01-12 | A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the fil… |
CVE-2023-6583 | Medium | 6.6 | 2024-01-11 | The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurr… |
CVE-2023-5504 | High | 8.7 | 2024-01-11 | The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticat… |
CVE-2023-6699 | Critical | 9.1 | 2024-01-11 | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the… |
CVE-2023-40439 | Low | 3.3 | 2024-01-10 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app… |
CVE-2023-40383 | Low | 3.3 | 2024-01-10 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data. |
CVE-2023-51127 | High | 7.5 | 2024-01-10 | FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows… |
CVE-2023-50916 | High | 7.2 | 2024-01-10 | Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. I… |
CVE-2023-37932 | Medium | 6.5 | 2024-01-10 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7… |
CVE-2023-48249 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“r… |
CVE-2023-48246 | Medium | 6.5 | 2024-01-10 | The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a c… |
CVE-2023-48243 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a cra… |
CVE-2023-48242 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (… |
CVE-2024-0354 | Medium | 5.3 | 2024-01-10 | A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the… |
CVE-2024-0341 | Low | 3.5 | 2024-01-09 | A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/def… |
CVE-2023-47890 | High | 8.8 | 2024-01-08 | pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. |
CVE-2023-47211 | Critical | 9.1 | 2024-01-08 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbi… |
CVE-2024-22050 | High | 7.5 | 2024-01-04 | Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via mal… |