CWE-22 · Path Traversal (page 42)
Page 42 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29962 | Medium | 6.5 | 2024-01-04 | S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability. |
CVE-2024-20805 | Low | 3.3 | 2024-01-04 | Path traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13 all… |
CVE-2024-20804 | Medium | 4.0 | 2024-01-04 | Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13… |
CVE-2024-21633 | High | 7.8 | 2024-01-03 | Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resourc… |
CVE-2023-37607 | High | 7.5 | 2024-01-03 | Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file=… |
CVE-2023-47473 | High | 7.5 | 2024-01-03 | Directory Traversal vulnerability in fuwushe.org iFair versions 23.8_ad0 and before allows an attacker to obtain sensitive information via a crafted script. |
CVE-2023-45723 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (… |
CVE-2023-45722 | High | 8.8 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended t… |
CVE-2023-41780 | Medium | 6.4 | 2024-01-03 | There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2023-7114 | High | 7.1 | 2023-12-29 | Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server. |
CVE-2023-52085 | Low | 3.3 | 2023-12-29 | Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that woul… |
CVE-2023-7134 | Medium | 6.3 | 2023-12-28 | A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipu… |
CVE-2023-50255 | Critical | 9.3 | 2023-12-27 | Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be… |
CVE-2023-6190 | Critical | 9.8 | 2023-12-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management… |
CVE-2023-5991 | Critical | 9.8 | 2023-12-26 | The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisati… |
CVE-2023-5672 | Medium | 6.5 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion… |
CVE-2022-41761 | Medium | 6.5 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the l… |
CVE-2022-41760 | Medium | 6.5 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename par… |
CVE-2023-30451 | Medium | 4.9 | 2023-12-25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the b… |
CVE-2023-6972 | Critical | 9.8 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-na… |
CVE-2023-51651 | Medium | 6.0 | 2023-12-22 | AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix d… |
CVE-2023-51449 | Medium | 5.6 | 2023-12-22 | Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python… |
CVE-2023-50731 | Critical | 9.1 | 2023-12-22 | MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not val… |
CVE-2023-50254 | Critical | 9.3 | 2023-12-22 | Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads… |
CVE-2023-46645 | Medium | 6.8 | 2023-12-21 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2023-6562 | High | 7.5 | 2023-12-20 | JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the… |
CVE-2023-47702 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2023-38126 | High | 7.2 | 2023-12-19 | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2023-6222 | High | 7.2 | 2023-12-18 | IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to per… |
CVE-2023-46177 | Medium | 6.5 | 2023-12-18 | IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-6908 | Low | 3.1 | 2023-12-18 | A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzip_file of the file kuiper/app/control… |
CVE-2023-6900 | Medium | 4.6 | 2023-12-17 | A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the… |
CVE-2023-6893 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some u… |
CVE-2023-6559 | High | 7.5 | 2023-12-16 | The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properl… |
CVE-2021-42797 | High | 7.5 | 2023-12-16 | Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access t… |
CVE-2023-50265 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename v… |
CVE-2023-50264 | High | 7.5 | 2023-12-15 | Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does no… |
CVE-2023-48389 | High | 7.5 | 2023-12-15 | Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerabi… |
CVE-2023-48382 | Medium | 6.5 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated r… |
CVE-2023-48381 | Medium | 6.5 | 2023-12-15 | Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacke… |
CVE-2023-48378 | High | 7.5 | 2023-12-15 | Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnera… |
CVE-2023-48373 | High | 7.5 | 2023-12-15 | ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit t… |
CVE-2023-6831 | High | 8.1 | 2023-12-15 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-49294 | Medium | 4.9 | 2023-12-14 | Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-aster… |
CVE-2023-48660 | High | 7.5 | 2023-12-14 | Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to re… |
CVE-2023-44278 | Medium | 6.7 | 2023-12-14 | Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. A local high privileged at… |
CVE-2023-6407 | Medium | 5.3 | 2023-12-14 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon se… |
CVE-2023-43586 | High | 7.3 | 2023-12-13 | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalat… |
CVE-2023-47624 | High | 7.5 | 2023-12-13 | Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files… |
CVE-2023-44251 | High | 8.3 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN ver… |
CVE-2023-6753 | High | 8.8 | 2023-12-13 | Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-49089 | High | 7.7 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permi… |
CVE-2023-28465 | High | 7.5 | 2023-12-12 | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories vi… |
CVE-2023-46455 | High | 7.5 | 2023-12-12 | In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload fun… |
CVE-2023-45316 | High | 7.3 | 2023-12-12 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker… |
CVE-2023-49058 | Low | 3.5 | 2023-12-12 | SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters… |
CVE-2023-36654 | Medium | 6.5 | 2023-12-12 | Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH pri… |
CVE-2023-50449 | High | 7.5 | 2023-12-10 | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
CVE-2023-6120 | Medium | 4.1 | 2023-12-09 | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file fu… |
CVE-2023-49788 | High | 7.2 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CO… |
CVE-2023-46497 | Medium | 5.4 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46496 | High | 8.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-46493 | Medium | 5.3 | 2023-12-08 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request t… |
CVE-2023-6577 | Medium | 4.3 | 2023-12-07 | A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2023-47440 | Medium | 6.5 | 2023-12-07 | Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attacke… |
CVE-2023-33411 | High | 7.5 | 2023-12-07 | A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devic… |
CVE-2023-46307 | High | 7.5 | 2023-12-07 | An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connectin… |
CVE-2023-6458 | High | 7.1 | 2023-12-06 | Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal. |
CVE-2023-5105 | Medium | 6.5 | 2023-12-04 | The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download fi… |
CVE-2023-44306 | Medium | 6.5 | 2023-12-04 | Dell DM5500 contains a path traversal vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability to… |
CVE-2023-49108 | High | 8.8 | 2023-12-04 | Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary… |
CVE-2018-25094 | Low | 3.5 | 2023-12-03 | A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of… |
CVE-2023-47279 | High | 7.5 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a si… |
CVE-2023-49735 | High | 7.5 | 2023-11-30 | ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definitio… |
CVE-2023-46690 | High | 8.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, w… |
CVE-2021-35975 | Medium | 5.3 | 2023-11-30 | Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote at… |
CVE-2023-6352 | Medium | 5.3 | 2023-11-30 | The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services… |
CVE-2023-6026 | Critical | 9.8 | 2023-11-30 | A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files sto… |
CVE-2023-47464 | High | 8.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function. |
CVE-2023-46886 | Critical | 9.1 | 2023-11-29 | Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allow… |
CVE-2023-48848 | High | 7.5 | 2023-11-28 | An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path. |
CVE-2023-3533 | Critical | 9.8 | 2023-11-28 | Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to pe… |
CVE-2023-5885 | Medium | 6.5 | 2023-11-27 | The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users. |
CVE-2022-41951 | High | 8.5 | 2023-11-27 | OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is poss… |
CVE-2023-42000 | Critical | 9.8 | 2023-11-27 | Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remot… |
CVE-2023-5607 | High | 8.4 | 2023-11-27 | An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior t… |
CVE-2023-6307 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2023-6118 | High | 7.5 | 2023-11-23 | Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1. |
CVE-2023-4593 | Medium | 6.5 | 2023-11-23 | Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent di… |
CVE-2023-6265 | Medium | 6.5 | 2023-11-22 | ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' para… |
CVE-2023-47467 | Medium | 6.5 | 2023-11-22 | Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure. |
CVE-2023-47251 | Medium | 6.5 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attack… |
CVE-2023-47313 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory… |
CVE-2023-6160 | Low | 3.3 | 2023-11-22 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the ma… |
CVE-2023-6252 | High | 7.5 | 2023-11-22 | Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files locate… |
CVE-2021-22151 | Low | 3.1 | 2023-11-22 | It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily travers… |
CVE-2023-48299 | Medium | 5.3 | 2023-11-21 | TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow manag… |
CVE-2023-6209 | Medium | 6.5 | 2023-11-21 | Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. T… |
CVE-2023-21418 | High | 7.1 | 2023-11-21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for fil… |