CWE-22 · Path Traversal (page 45)
Page 45 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32004 | High | 8.8 | 2023-08-15 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buf… |
CVE-2023-32003 | Medium | 5.3 | 2023-08-15 | `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in… |
CVE-2023-21268 | Medium | 5.5 | 2023-08-14 | In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error. This could lead to local denial of servic… |
CVE-2023-40274 | High | 7.5 | 2023-08-14 | An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory trav… |
CVE-2023-39402 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39401 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39400 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2021-26504 | High | 7.5 | 2023-08-11 | Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request i… |
CVE-2020-27514 | Critical | 9.1 | 2023-08-11 | Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files… |
CVE-2023-32563 | Critical | 9.8 | 2023-08-10 | An unauthenticated attacker could achieve the code execution through a RemoteControl server. |
CVE-2023-39964 | High | 7.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary im… |
CVE-2023-39957 | High | 7.8 | 2023-08-10 | Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicio… |
CVE-2023-38997 | High | 7.2 | 2023-08-09 | A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attacke… |
CVE-2023-31450 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permission… |
CVE-2023-31449 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permiss… |
CVE-2023-31448 | Medium | 4.7 | 2023-08-09 | A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with write permissions co… |
CVE-2023-38176 | High | 7.0 | 2023-08-08 | Azure Arc-Enabled Servers Elevation of Privilege Vulnerability |
CVE-2023-36534 | Critical | 9.3 | 2023-08-08 | Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. |
CVE-2023-37646 | High | 7.8 | 2023-08-08 | An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal. |
CVE-2023-33756 | High | 7.5 | 2023-08-08 | An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal. |
CVE-2023-24698 | High | 7.5 | 2023-08-08 | Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying… |
CVE-2023-39528 | Medium | 6.8 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server… |
CVE-2023-39525 | Medium | 6.5 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying… |
CVE-2023-36220 | High | 7.2 | 2023-08-07 | Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive infor… |
CVE-2023-4172 | Medium | 4.3 | 2023-08-05 | A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some… |
CVE-2020-26065 | Medium | 6.5 | 2023-08-04 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal… |
CVE-2023-38702 | Critical | 9.9 | 2023-08-04 | Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-se… |
CVE-2023-38695 | Medium | 6.5 | 2023-08-04 | cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file p… |
CVE-2023-39143 | Critical | 9.8 | 2023-08-04 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote… |
CVE-2023-37896 | High | 7.5 | 2023-08-04 | Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running cust… |
CVE-2023-38708 | Medium | 6.3 | 2023-08-04 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `… |
CVE-2023-38951 | Critical | 9.8 | 2023-08-03 | ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted… |
CVE-2023-38950 | High | 7.5 | 2023-08-03 | A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payl… |
CVE-2023-0956 | High | 7.5 | 2023-08-03 | External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements… |
CVE-2023-35081 | High | 7.2 | 2023-08-03 | A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to… |
CVE-2023-33365 | High | 7.5 | 2023-08-03 | A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web… |
CVE-2023-3348 | Medium | 5.7 | 2023-08-03 | The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development se… |
CVE-2022-26838 | Medium | 6.5 | 2023-08-03 | Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service… |
CVE-2023-38956 | High | 7.5 | 2023-08-03 | A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. |
CVE-2023-33369 | Critical | 9.1 | 2023-08-03 | A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a… |
CVE-2023-3329 | Medium | 6.5 | 2023-08-02 | SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the… |
CVE-2023-26441 | Medium | 5.7 | 2023-08-02 | Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access… |
CVE-2023-3385 | Medium | 6.3 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-31427 | High | 7.8 | 2023-08-01 | Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Broca… |
CVE-2022-42182 | Medium | 5.3 | 2023-07-31 | Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal. |
CVE-2023-35016 | Medium | 6.5 | 2023-07-31 | IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially c… |
CVE-2023-37218 | High | 7.5 | 2023-07-30 | Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2020-22623 | High | 7.5 | 2023-07-27 | Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information. |
CVE-2023-23842 | High | 7.2 | 2023-07-26 | The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative acce… |
CVE-2022-31457 | High | 7.5 | 2023-07-25 | RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/. |
CVE-2023-37460 | High | 8.1 | 2023-07-25 | Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to… |
CVE-2022-46902 | High | 7.5 | 2023-07-25 | An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console c… |
CVE-2022-46900 | Medium | 6.5 | 2023-07-25 | An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console… |
CVE-2022-46898 | Critical | 9.8 | 2023-07-25 | An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Repor… |
CVE-2023-33777 | Medium | 5.3 | 2023-07-25 | An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack. |
CVE-2023-26045 | Critical | 10.0 | 2023-07-24 | NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in t… |
CVE-2023-34478 | Critical | 9.8 | 2023-07-24 | Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with AP… |
CVE-2023-38633 | Medium | 5.5 | 2023-07-22 | A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem… |
CVE-2023-3813 | High | 7.5 | 2023-07-21 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthent… |
CVE-2023-30200 | High | 7.5 | 2023-07-20 | In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest c… |
CVE-2023-37601 | High | 7.5 | 2023-07-20 | Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts. |
CVE-2023-31461 | High | 7.5 | 2023-07-20 | Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location… |
CVE-2023-2913 | High | 7.5 | 2023-07-18 | An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disa… |
CVE-2023-37476 | Medium | 5.5 | 2023-07-17 | OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code exe… |
CVE-2023-37781 | Medium | 6.5 | 2023-07-17 | An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file. |
CVE-2023-37461 | Medium | 5.6 | 2023-07-17 | Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which ma… |
CVE-2023-38337 | High | 7.5 | 2023-07-14 | rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the… |
CVE-2023-37474 | High | 7.5 | 2023-07-14 | Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal… |
CVE-2023-35069 | High | 7.5 | 2023-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Traversal. This issue affects Bullwark: b… |
CVE-2023-34135 | Medium | 6.5 | 2023-07-13 | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via… |
CVE-2023-34129 | High | 8.8 | 2023-07-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote atta… |
CVE-2023-34125 | Medium | 6.5 | 2023-07-13 | Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges… |
CVE-2023-26564 | Critical | 9.8 | 2023-07-12 | The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker… |
CVE-2023-26563 | Critical | 9.8 | 2023-07-12 | The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Win… |
CVE-2023-37960 | Medium | 6.5 | 2023-07-12 | Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins contr… |
CVE-2023-22887 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended director… |
CVE-2023-34117 | Low | 3.3 | 2023-07-11 | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
CVE-2023-25606 | Medium | 6.5 | 2023-07-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface… |
CVE-2022-23447 | High | 7.5 | 2023-07-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7… |
CVE-2023-33989 | High | 8.7 | 2023-07-11 | An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to o… |
CVE-2023-35887 | Medium | 5.0 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache M… |
CVE-2023-1183 | Medium | 5.0 | 2023-07-10 | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the f… |
CVE-2023-37288 | Medium | 6.5 | 2023-07-10 | SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerabili… |
CVE-2023-36460 | Critical | 9.9 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers… |
CVE-2023-23907 | High | 7.5 | 2023-07-06 | A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to arbitr… |
CVE-2023-23547 | Medium | 6.5 | 2023-07-06 | A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can… |
CVE-2020-21862 | High | 8.1 | 2023-07-06 | Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del. |
CVE-2023-30678 | Medium | 5.1 | 2023-07-06 | Potential zip path traversal vulnerability in Calendar application prior to version 12.4.07.15 in Android 13 allows attackers to write arbitrary file. |
CVE-2023-24256 | High | 7.8 | 2023-07-06 | An issue in the com.nextev.datastatistic component of NIO EC6 Aspen before v3.3.0 allows attackers to escalate privileges via path traversal. |
CVE-2023-36827 | High | 7.5 | 2023-07-05 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-36822 | Medium | 6.5 | 2023-07-05 | Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install p… |
CVE-2023-35975 | Medium | 6.5 | 2023-07-05 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the abilit… |
CVE-2023-2880 | High | 7.5 | 2023-07-05 | Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a… |
CVE-2023-36819 | Medium | 6.5 | 2023-07-03 | Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-serv… |
CVE-2023-35947 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle di… |
CVE-2023-35946 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache… |
CVE-2023-32608 | Medium | 6.5 | 2023-06-30 | Directory traversal vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a remote authenticated attacker… |
CVE-2023-33277 | High | 7.5 | 2023-06-29 | The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequenc… |
CVE-2023-34598 | Critical | 9.8 | 2023-06-29 | Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in… |
CVE-2023-34843 | High | 7.5 | 2023-06-29 | Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request. |