CWE-22 · Path Traversal (page 43)
Page 43 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21417 | High | 7.1 | 2023-11-21 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allo… |
CVE-2023-38879 | High | 7.5 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'fi… |
CVE-2023-48185 | High | 7.5 | 2023-11-17 | Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request. |
CVE-2023-22273 | High | 7.2 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2023-47283 | Medium | 4.9 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the sys… |
CVE-2023-42428 | Medium | 6.5 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and… |
CVE-2023-45382 | High | 7.5 | 2023-11-17 | In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restri… |
CVE-2023-6021 | High | 7.5 | 2023-11-16 | LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' re… |
CVE-2023-6023 | High | 7.5 | 2023-11-16 | An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. |
CVE-2023-6015 | High | 7.5 | 2023-11-16 | MLflow allowed arbitrary files to be PUT onto the server. |
CVE-2023-5245 | High | 7.5 | 2023-11-15 | FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directo… |
CVE-2023-34062 | High | 7.5 | 2023-11-15 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted… |
CVE-2023-6032 | Medium | 5.3 | 2023-11-15 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and f… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-33878 | Medium | 6.7 | 2023-11-14 | Path transversal in some Intel(R) NUC P14E Laptop Element Audio Install Package software before version 156 for Windows may allow an authenticated user to pote… |
CVE-2023-32655 | Medium | 6.7 | 2023-11-14 | Path transversal in some Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software before version 1.0.10.3 f… |
CVE-2023-32278 | Medium | 6.7 | 2023-11-14 | Path transversal in some Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 Laptop Kits - LAPRC510 & LAPRC710 Uniwill Service Driver installation softwar… |
CVE-2023-24592 | High | 7.3 | 2023-11-14 | Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated user to potentially enable escalation… |
CVE-2022-27229 | Medium | 6.7 | 2023-11-14 | Path transversal in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticated u… |
CVE-2023-45880 | High | 7.2 | 2023-11-14 | GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateF… |
CVE-2023-47246 | Critical | 9.8 | 2023-11-10 | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited… |
CVE-2023-45283 | High | 7.5 | 2023-11-09 | The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a… |
CVE-2023-40055 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-40054 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-47613 | Medium | 4.4 | 2023-11-09 | A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, T… |
CVE-2023-36667 | High | 7.5 | 2023-11-08 | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. |
CVE-2023-46253 | Critical | 9.1 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore… |
CVE-2023-5355 | High | 8.1 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete… |
CVE-2023-39299 | High | 7.5 | 2023-11-03 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected… |
CVE-2023-3961 | Critical | 9.1 | 2023-11-03 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba ty… |
CVE-2023-41356 | Medium | 6.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-41344 | High | 7.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-34260 | High | 7.5 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory refe… |
CVE-2023-34259 | Medium | 4.9 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even f… |
CVE-2023-20220 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2023-33227 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to pe… |
CVE-2023-33226 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-2621 | Medium | 6.5 | 2023-11-01 | The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerabil… |
CVE-2023-46237 | Medium | 5.8 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration… |
CVE-2023-43648 | Medium | 4.9 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management featur… |
CVE-2023-42804 | Low | 3.1 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with… |
CVE-2023-46864 | Medium | 5.3 | 2023-10-30 | Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. |
CVE-2023-46863 | High | 7.5 | 2023-10-30 | Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. |
CVE-2005-10002 | Medium | 5.5 | 2023-10-29 | A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downlo… |
CVE-2023-27170 | High | 7.5 | 2023-10-26 | Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter. |
CVE-2018-16739 | High | 8.8 | 2023-10-26 | An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute cod… |
CVE-2023-45868 | High | 8.1 | 2023-10-26 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on c… |
CVE-2023-45867 | Medium | 6.5 | 2023-10-26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a pri… |
CVE-2023-30967 | Critical | 9.8 | 2023-10-26 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files… |
CVE-2023-46346 | High | 7.5 | 2023-10-25 | In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download… |
CVE-2023-46119 | High | 7.5 | 2023-10-25 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without exte… |
CVE-2023-42488 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-26578 | High | 8.8 | 2023-10-25 | Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP… |
CVE-2022-38485 | Medium | 6.5 | 2023-10-25 | A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker cou… |
CVE-2022-38484 | High | 8.8 | 2023-10-25 | An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to versi… |
CVE-2023-37532 | Medium | 5.8 | 2023-10-23 | HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. |
CVE-2023-46122 | Low | 3.9 | 2023-10-23 | sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potent… |
CVE-2021-26736 | Medium | 6.7 | 2023-10-23 | Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged… |
CVE-2021-46897 | Medium | 6.5 | 2023-10-22 | views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving pr… |
CVE-2023-44256 | Medium | 6.5 | 2023-10-20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager ve… |
CVE-2023-5414 | Critical | 9.1 | 2023-10-20 | The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allo… |
CVE-2023-4274 | High | 8.7 | 2023-10-20 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authen… |
CVE-2023-45823 | High | 7.5 | 2023-10-19 | Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit… |
CVE-2023-45278 | Critical | 9.1 | 2023-10-19 | Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE req… |
CVE-2023-45277 | High | 7.5 | 2023-10-19 | Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base… |
CVE-2023-35187 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to a… |
CVE-2023-35185 | Medium | 6.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. |
CVE-2023-31046 | Medium | 6.5 | 2023-10-19 | A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an au… |
CVE-2023-5241 | Critical | 9.6 | 2023-10-19 | The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetrain… |
CVE-2023-5212 | Critical | 9.6 | 2023-10-19 | The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it po… |
CVE-2023-43801 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43803 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43802 | High | 7.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filenam… |
CVE-2023-45383 | High | 7.5 | 2023-10-18 | In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information withou… |
CVE-2023-39332 | Critical | 9.8 | 2023-10-18 | Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Arr… |
CVE-2023-39331 | High | 7.5 | 2023-10-18 | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the imp… |
CVE-2023-34208 | Medium | 6.5 | 2023-10-17 | Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary dir… |
CVE-2023-43121 | High | 7.5 | 2023-10-16 | A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 a… |
CVE-2023-45689 | Medium | 6.5 | 2023-10-16 | Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with adm… |
CVE-2023-45688 | Medium | 4.3 | 2023-10-16 | Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of a… |
CVE-2023-45686 | High | 7.2 | 2023-10-16 | Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated atta… |
CVE-2023-45685 | Critical | 9.1 | 2023-10-16 | Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authent… |
CVE-2023-21415 | Medium | 6.5 | 2023-10-16 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for fi… |
CVE-2023-5588 | Low | 2.6 | 2023-10-15 | A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/p… |
CVE-2023-38312 | High | 7.5 | 2023-10-15 | A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the… |
CVE-2022-33165 | Medium | 6.8 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2023-45855 | High | 7.5 | 2023-10-14 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. |
CVE-2023-32974 | High | 7.5 | 2023-10-13 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-41682 | High | 8.1 | 2023-10-13 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5… |
CVE-2023-4990 | High | 8.3 | 2023-10-11 | Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files. |
CVE-2023-41373 | Critical | 9.9 | 2023-10-10 | A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP syst… |
CVE-2023-42796 | High | 7.5 | 2023-10-10 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web serv… |
CVE-2023-45352 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-36123 | High | 7.8 | 2023-10-07 | Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive… |
CVE-2023-23366 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-23365 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-43070 | Medium | 6.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could pote… |
CVE-2023-5399 | Critical | 9.8 | 2023-10-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the p… |
CVE-2023-3701 | Critical | 9.9 | 2023-10-04 | Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged use… |