CWE-22 · Path Traversal (page 44)
Page 44 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3512 | High | 7.5 | 2023-10-04 | Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker… |
CVE-2023-26152 | High | 7.5 | 2023-10-03 | All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server… |
CVE-2023-43627 | Medium | 5.7 | 2023-10-03 | Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticate… |
CVE-2023-5327 | Low | 3.5 | 2023-10-01 | A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been rated as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2022-35908 | High | 8.8 | 2023-09-29 | Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent. |
CVE-2023-5257 | Low | 3.5 | 2023-09-29 | A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest o… |
CVE-2023-43662 | High | 8.6 | 2023-09-28 | ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authenticati… |
CVE-2023-43044 | Medium | 5.3 | 2023-09-28 | IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request contain… |
CVE-2023-40026 | Medium | 5.0 | 2023-09-27 | Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any versi… |
CVE-2023-44172 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php. |
CVE-2023-44171 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php. |
CVE-2023-44170 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php. |
CVE-2023-44169 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php. |
CVE-2023-43825 | High | 7.8 | 2023-09-27 | Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an arbitrary code by having a legitimate user… |
CVE-2023-43216 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php. |
CVE-2023-42819 | High | 8.9 | 2023-09-27 | JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu… |
CVE-2023-42657 | Critical | 9.9 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to pe… |
CVE-2023-42487 | High | 7.5 | 2023-09-27 | Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2023-42462 | High | 7.7 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41888 | Medium | 5.3 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-40532 | Medium | 4.3 | 2023-09-27 | Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the fi… |
CVE-2023-2315 | High | 8.1 | 2023-09-27 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary fi… |
CVE-2022-4244 | High | 7.5 | 2023-09-25 | A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the inte… |
CVE-2023-43382 | High | 8.8 | 2023-09-25 | Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in the uploaded template… |
CVE-2023-43256 | Medium | 6.5 | 2023-09-25 | A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-saniti… |
CVE-2023-41302 | High | 7.5 | 2023-09-25 | Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerability may cause features to perform abnorm… |
CVE-2023-39407 | Critical | 9.1 | 2023-09-25 | The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2023-5142 | Low | 3.7 | 2023-09-24 | A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER… |
CVE-2023-38346 | High | 8.8 | 2023-09-22 | An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an… |
CVE-2023-42280 | High | 7.5 | 2023-09-21 | mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not verify the incoming data, resulting in a… |
CVE-2023-42456 | Low | 3.3 | 2023-09-21 | Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authen… |
CVE-2023-4760 | High | 7.6 | 2023-09-21 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reas… |
CVE-2023-4152 | High | 7.5 | 2023-09-21 | Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a… |
CVE-2015-5467 | Critical | 9.8 | 2023-09-21 | web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter. |
CVE-2023-40930 | Medium | 6.8 | 2023-09-20 | An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/. |
CVE-2022-45447 | Medium | 6.5 | 2023-09-20 | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly ch… |
CVE-2023-43616 | Medium | 5.5 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction. |
CVE-2023-41599 | Medium | 5.3 | 2023-09-19 | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
CVE-2022-28357 | Critical | 9.8 | 2023-09-19 | NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account. |
CVE-2023-37739 | Medium | 6.5 | 2023-09-14 | i-doit Pro v25 and below was discovered to be vulnerable to path traversal. |
CVE-2021-28485 | Medium | 4.3 | 2023-09-14 | In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the h… |
CVE-2023-39916 | Critical | 9.3 | 2023-09-13 | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the op… |
CVE-2023-4914 | High | 7.5 | 2023-09-12 | Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1. |
CVE-2023-32558 | High | 7.5 | 2023-09-12 | The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the expe… |
CVE-2023-35670 | High | 7.8 | 2023-09-11 | In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error… |
CVE-2023-38256 | Medium | 6.8 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 vulnerable to a path traversal atta… |
CVE-2022-33164 | High | 8.7 | 2023-09-08 | IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request… |
CVE-2023-41578 | High | 7.5 | 2023-09-08 | Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection. |
CVE-2023-4782 | Medium | 6.3 | 2023-09-08 | Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulne… |
CVE-2023-40924 | High | 7.5 | 2023-09-08 | SolarView Compact < 6.00 is vulnerable to Directory Traversal. |
CVE-2023-39584 | High | 7.5 | 2023-09-08 | Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability. |
CVE-2021-35980 | High | 7.8 | 2023-09-06 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnera… |
CVE-2021-28644 | High | 7.8 | 2023-09-06 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnera… |
CVE-2023-41930 | Medium | 4.3 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing… |
CVE-2023-4480 | Medium | 5.5 | 2023-09-05 | Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows… |
CVE-2023-39448 | High | 8.8 | 2023-09-05 | Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting… |
CVE-2023-4748 | Medium | 6.3 | 2023-09-05 | A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file Pr… |
CVE-2023-41057 | Medium | 5.5 | 2023-09-04 | hyper-bump-it is a command line tool for updating the version in project files.`hyper-bump-it` reads a file glob pattern from the configuration file. That is c… |
CVE-2023-4616 | High | 7.5 | 2023-09-04 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to e… |
CVE-2023-4615 | High | 7.5 | 2023-09-04 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to e… |
CVE-2023-4614 | Critical | 9.8 | 2023-09-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit t… |
CVE-2023-4613 | Critical | 9.8 | 2023-09-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit t… |
CVE-2023-39912 | Medium | 4.9 | 2023-08-31 | Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. |
CVE-2023-41747 | Medium | 6.5 | 2023-08-31 | Sensitive information disclosure due to unauthenticated path traversal. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.2… |
CVE-2023-41044 | Low | 3.3 | 2023-08-31 | Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is c… |
CVE-2023-31167 | Medium | 5.0 | 2023-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Sc… |
CVE-2023-41040 | Medium | 4.0 | 2023-08-30 | GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory… |
CVE-2023-39139 | High | 7.8 | 2023-08-30 | An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. |
CVE-2023-39138 | High | 7.8 | 2023-08-30 | An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file. |
CVE-2023-39135 | High | 7.8 | 2023-08-30 | An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry. |
CVE-2023-40597 | High | 7.8 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located… |
CVE-2023-41266 | High | 8.2 | 2023-08-29 | A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, Novembe… |
CVE-2023-39559 | Medium | 5.3 | 2023-08-29 | AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability. |
CVE-2023-20890 | High | 7.2 | 2023-08-29 | Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operati… |
CVE-2023-40828 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the… |
CVE-2023-40827 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter. |
CVE-2023-40826 | High | 7.5 | 2023-08-28 | An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter. |
CVE-2023-39810 | High | 7.8 | 2023-08-28 | An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. |
CVE-2023-40587 | Medium | 4.3 | 2023-08-25 | Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using… |
CVE-2023-3406 | High | 7.7 | 2023-08-25 | Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read… |
CVE-2023-32756 | High | 7.5 | 2023-08-25 | e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exp… |
CVE-2023-39699 | Critical | 9.8 | 2023-08-25 | IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerab… |
CVE-2023-39026 | High | 7.5 | 2023-08-22 | Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a cr… |
CVE-2020-24113 | Critical | 9.1 | 2023-08-22 | Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and caus… |
CVE-2023-39141 | High | 7.5 | 2023-08-22 | webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. |
CVE-2023-37428 | High | 7.2 | 2023-08-22 | A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underl… |
CVE-2023-25914 | High | 8.8 | 2023-08-21 | Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information t… |
CVE-2023-2971 | Medium | 6.3 | 2023-08-19 | Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers… |
CVE-2023-2316 | High | 7.4 | 2023-08-19 | Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via… |
CVE-2023-2110 | High | 8.2 | 2023-08-19 | Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remot… |
CVE-2023-26469 | Critical | 9.8 | 2023-08-17 | In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. |
CVE-2023-2917 | Critical | 9.8 | 2023-08-17 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversa… |
CVE-2023-2915 | High | 7.5 | 2023-08-17 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vu… |
CVE-2023-3698 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete fil… |
CVE-2023-3697 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create fil… |
CVE-2023-34217 | High | 8.1 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-34216 | High | 8.1 | 2023-08-17 | TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. Th… |
CVE-2023-20229 | High | 7.1 | 2023-08-16 | A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacker with low privileg… |
CVE-2020-26037 | Critical | 9.8 | 2023-08-16 | Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary cod… |
CVE-2023-40028 | Medium | 4.9 | 2023-08-15 | Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files tha… |