CWE-22 · Path Traversal (page 46)
Page 46 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32623 | Critical | 9.1 | 2023-06-28 | Directory traversal vulnerability in Snow Monkey Forms v5.1.1 and earlier allows a remote unauthenticated attacker to delete arbitrary files on the server. |
CVE-2023-3331 | Medium | 5.4 | 2023-06-28 | Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG… |
CVE-2023-3330 | Medium | 4.3 | 2023-06-28 | Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP… |
CVE-2020-19902 | Critical | 9.8 | 2023-06-27 | Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter. |
CVE-2023-30945 | Critical | 9.8 | 2023-06-26 | Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary… |
CVE-2023-32557 | Critical | 9.8 | 2023-06-26 | A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the… |
CVE-2023-32522 | High | 8.1 | 2023-06-26 | A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbi… |
CVE-2023-32521 | Critical | 9.1 | 2023-06-26 | A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to d… |
CVE-2023-36301 | High | 7.5 | 2023-06-26 | Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. |
CVE-2023-25307 | High | 7.8 | 2023-06-26 | nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal. |
CVE-2023-25306 | High | 7.5 | 2023-06-26 | MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal. |
CVE-2023-36612 | High | 7.5 | 2023-06-25 | Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in th… |
CVE-2023-35169 | Critical | 9.0 | 2023-06-23 | PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized at… |
CVE-2023-35801 | High | 8.1 | 2023-06-23 | A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource c… |
CVE-2023-34939 | Critical | 9.8 | 2023-06-22 | Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx. |
CVE-2023-35843 | High | 7.5 | 2023-06-19 | NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manip… |
CVE-2023-35852 | High | 7.5 | 2023-06-19 | In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolu… |
CVE-2023-35844 | High | 7.5 | 2023-06-19 | packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intende… |
CVE-2023-35840 | Medium | 6.5 | 2023-06-19 | _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector. |
CVE-2023-25186 | Medium | 5.1 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardenings from a Nokia Si… |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
CVE-2023-34880 | Critical | 9.8 | 2023-06-15 | cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerabilit… |
CVE-2023-2270 | High | 7.0 | 2023-06-15 | The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The co… |
CVE-2023-34865 | Critical | 9.8 | 2023-06-14 | Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature. |
CVE-2023-3241 | Low | 3.5 | 2023-06-14 | A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?m… |
CVE-2022-42474 | Medium | 6.5 | 2023-06-13 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy ver… |
CVE-2023-2278 | Critical | 9.8 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. T… |
CVE-2023-34342 | Medium | 6.0 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, which may lead to… |
CVE-2023-34345 | Medium | 6.5 | 2023-06-12 | AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lead to information… |
CVE-2023-30198 | High | 7.5 | 2023-06-12 | Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. |
CVE-2023-2688 | Medium | 4.9 | 2023-06-09 | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the… |
CVE-2023-3172 | High | 7.2 | 2023-06-09 | Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-34096 | Medium | 6.5 | 2023-06-08 | Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `… |
CVE-2023-34238 | Medium | 4.3 | 2023-06-08 | Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability… |
CVE-2023-29502 | Medium | 6.2 | 2023-06-07 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path. |
CVE-2023-1864 | Medium | 6.8 | 2023-06-07 | FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to a path traversal, which could allow an attacker to remotely read files on the system… |
CVE-2023-33510 | High | 7.5 | 2023-06-07 | Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. |
CVE-2020-36728 | Medium | 6.5 | 2023-06-07 | The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthentica… |
CVE-2023-34409 | Critical | 9.8 | 2023-06-06 | In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL p… |
CVE-2023-33747 | High | 7.8 | 2023-06-06 | CloudPanel v2.2.2 allows attackers to execute a path traversal. |
CVE-2023-33524 | Medium | 5.3 | 2023-06-05 | Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host wh… |
CVE-2023-33690 | Medium | 6.5 | 2023-06-05 | SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS. |
CVE-2023-3098 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulati… |
CVE-2023-34407 | High | 7.5 | 2023-06-05 | OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL. |
CVE-2023-28163 | Medium | 6.5 | 2023-06-02 | When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those… |
CVE-2023-25750 | Medium | 4.3 | 2023-06-02 | Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Fi… |
CVE-2023-3031 | Medium | 4.9 | 2023-06-02 | Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to… |
CVE-2023-29736 | Critical | 9.8 | 2023-06-01 | Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its interna… |
CVE-2023-27640 | High | 7.5 | 2023-06-01 | An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parame… |
CVE-2023-27639 | High | 7.5 | 2023-06-01 | An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parame… |
CVE-2023-32714 | High | 8.1 | 2023-06-01 | In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal explo… |
CVE-2023-33544 | Medium | 5.5 | 2023-06-01 | hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being s… |
CVE-2023-29159 | High | 7.5 | 2023-06-01 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web se… |
CVE-2023-2909 | High | 8.5 | 2023-05-31 | EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected prod… |
CVE-2023-2435 | High | 7.2 | 2023-05-31 | The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribute. This allows edit… |
CVE-2023-30197 | High | 7.5 | 2023-05-31 | Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information withou… |
CVE-2023-28344 | High | 7.1 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly… |
CVE-2022-47526 | Critical | 9.8 | 2023-05-31 | Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could lever… |
CVE-2023-33177 | High | 8.8 | 2023-05-30 | Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CM… |
CVE-2022-36243 | Medium | 5.3 | 2023-05-30 | Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure T… |
CVE-2023-30196 | High | 7.5 | 2023-05-30 | Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php. |
CVE-2022-24632 | Medium | 5.3 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php vi… |
CVE-2022-24629 | Critical | 9.8 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir… |
CVE-2021-27825 | High | 7.5 | 2023-05-29 | A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL. |
CVE-2023-29380 | High | 7.5 | 2023-05-29 | Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames. |
CVE-2023-32676 | Medium | 6.7 | 2023-05-26 | Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functiona… |
CVE-2023-32317 | Medium | 6.7 | 2023-05-26 | Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functiona… |
CVE-2023-32315 | High | 8.6 | 2023-05-26 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerabl… |
CVE-2023-27311 | Medium | 5.3 | 2023-05-26 | NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the… |
CVE-2023-2825 | Critical | 10.0 | 2023-05-26 | An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read ar… |
CVE-2022-46945 | Critical | 9.1 | 2023-05-26 | Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php. |
CVE-2023-28382 | High | 8.1 | 2023-05-26 | Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Aff… |
CVE-2023-26216 | Critical | 9.1 | 2023-05-25 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory ac… |
CVE-2023-26215 | High | 7.7 | 2023-05-25 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to rea… |
CVE-2023-31861 | High | 7.5 | 2023-05-25 | ZLMediaKit 4.0 is vulnerable to Directory Traversal. |
CVE-2023-28413 | Critical | 9.8 | 2023-05-23 | Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, al… |
CVE-2023-28408 | Critical | 9.8 | 2023-05-23 | Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-… |
CVE-2023-27507 | Critical | 9.8 | 2023-05-23 | MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled… |
CVE-2020-20012 | Critical | 9.8 | 2023-05-23 | WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access Control. |
CVE-2023-27067 | High | 7.5 | 2023-05-22 | Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downl… |
CVE-2023-27066 | Medium | 6.5 | 2023-05-22 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlha… |
CVE-2023-30199 | High | 7.5 | 2023-05-19 | Prestashop customexporter <= 1.7.20 is vulnerable to Incorrect Access Control via modules/customexporter/downloads/download.php. |
CVE-2022-36328 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitra… |
CVE-2022-36327 | Medium | 5.8 | 2023-05-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with cert… |
CVE-2023-32322 | Medium | 4.9 | 2023-05-18 | Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an… |
CVE-2023-20167 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20166 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20087 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to downloa… |
CVE-2023-20077 | Medium | 4.9 | 2023-05-18 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to downloa… |
CVE-2023-32767 | High | 7.5 | 2023-05-17 | The web interface of Symcon IP-Symcon before 6.3 (i.e., before 2023-05-12) allows a remote attacker to read sensitive files via .. directory-traversal sequence… |
CVE-2023-31904 | High | 7.5 | 2023-05-17 | savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion. |
CVE-2023-2745 | Medium | 5.4 | 2023-05-17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers t… |
CVE-2023-30509 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-30508 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-30507 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-2196 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-spe… |
CVE-2023-32985 | Medium | 4.3 | 2023-05-16 | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Rea… |
CVE-2023-31131 | High | 7.4 | 2023-05-15 | Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extrac… |
CVE-2023-32309 | High | 7.5 | 2023-05-15 | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using includ… |
CVE-2023-23169 | Medium | 6.5 | 2023-05-12 | Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. |