CWE-22 · Path Traversal (page 47)
Page 47 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31851 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthen… |
CVE-2024-31850 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthent… |
CVE-2024-31849 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unaut… |
CVE-2024-31848 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an un… |
CVE-2024-31220 | High | 7.3 | 2024-04-05 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbi… |
CVE-2024-29672 | High | 8.8 | 2024-04-05 | Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in K… |
CVE-2024-3311 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of… |
CVE-2024-30270 | Medium | 6.2 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30254 | Medium | 5.8 | 2024-04-04 | MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files i… |
CVE-2024-25693 | Critical | 9.9 | 2024-04-04 | There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file… |
CVE-2024-27575 | High | 7.5 | 2024-04-04 | INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/di… |
CVE-2024-23540 | Medium | 5.3 | 2024-04-03 | The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The Big… |
CVE-2024-20352 | Medium | 4.9 | 2024-04-03 | A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attac… |
CVE-2024-20348 | High | 7.5 | 2024-04-03 | A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote a… |
CVE-2023-35812 | Medium | 5.3 | 2024-04-03 | An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these speci… |
CVE-2024-29434 | High | 8.3 | 2024-04-02 | An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file. |
CVE-2016-15038 | Medium | 6.5 | 2024-04-01 | A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The ma… |
CVE-2024-25944 | Medium | 5.7 | 2024-03-29 | Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulner… |
CVE-2024-30492 | Medium | 4.3 | 2024-03-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Impo… |
CVE-2024-3078 | Medium | 5.5 | 2024-03-29 | A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/s… |
CVE-2021-31156 | High | 7.5 | 2024-03-28 | Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data. |
CVE-2023-25341 | Medium | 6.5 | 2024-03-28 | A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to the user via GET r… |
CVE-2023-42947 | High | 8.6 | 2024-03-28 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvO… |
CVE-2024-0980 | High | 7.1 | 2024-03-28 | The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. |
CVE-2023-0582 | High | 8.1 | 2024-03-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This… |
CVE-2024-28335 | Critical | 9.1 | 2024-03-27 | Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the vi… |
CVE-2024-2210 | Medium | 6.4 | 2024-03-27 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Li… |
CVE-2024-2203 | Medium | 6.4 | 2024-03-27 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget… |
CVE-2024-25136 | High | 7.5 | 2024-03-26 | There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. |
CVE-2023-52623 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running… |
CVE-2023-41973 | High | 7.3 | 2024-03-26 | ZSATray passes the previousInstallerName as a config parameter to TrayManager, and TrayManager constructs the path and appends previousInstallerName to get the… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-2863 | Medium | 5.3 | 2024-03-25 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. |
CVE-2024-2227 | Critical | 10.0 | 2024-03-22 | This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.2… |
CVE-2024-28171 | High | 8.1 | 2024-03-21 | It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file sys… |
CVE-2024-25567 | High | 8.1 | 2024-03-21 | Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already e… |
CVE-2024-27921 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version… |
CVE-2024-29180 | High | 7.4 | 2024-03-21 | Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficientl… |
CVE-2024-1142 | Medium | 5.4 | 2024-03-21 | Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Versi… |
CVE-2024-23721 | High | 7.5 | 2024-03-20 | A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and… |
CVE-2023-41877 | High | 7.2 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.2… |
CVE-2024-21677 | High | 8.8 | 2024-03-19 | This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Scor… |
CVE-2023-40279 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do. |
CVE-2024-24043 | Medium | 5.5 | 2024-03-19 | Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted file. |
CVE-2024-24042 | High | 8.8 | 2024-03-19 | Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResou… |
CVE-2023-40280 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp. |
CVE-2024-27771 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE |
CVE-2024-27770 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal |
CVE-2024-27768 | Critical | 9.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE |
CVE-2023-40747 | High | 7.5 | 2024-03-18 | Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerabili… |
CVE-2023-40160 | Low | 3.7 | 2024-03-18 | Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnera… |
CVE-2024-2294 | Medium | 4.9 | 2024-03-16 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the… |
CVE-2024-25156 | Medium | 6.5 | 2024-03-14 | A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywh… |
CVE-2024-22398 | Medium | 4.9 | 2024-03-14 | An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attack… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2024-1358 | High | 8.8 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. T… |
CVE-2023-6825 | Critical | 9.9 | 2024-03-13 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version)… |
CVE-2024-25154 | Medium | 5.3 | 2024-03-13 | Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files lo… |
CVE-2024-27317 | High | 8.4 | 2024-03-12 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Wo… |
CVE-2024-21400 | Critical | 9.0 | 2024-03-12 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-1303 | Medium | 6.5 | 2024-03-12 | Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerabilit… |
CVE-2024-27279 | Medium | 6.5 | 2024-03-12 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2… |
CVE-2024-27121 | High | 7.2 | 2024-03-12 | Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected p… |
CVE-2023-47221 | Medium | 5.5 | 2024-03-08 | A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the… |
CVE-2024-2318 | Medium | 4.3 | 2024-03-08 | A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2024-23216 | High | 7.1 | 2024-03-08 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may… |
CVE-2024-0818 | Critical | 9.1 | 2024-03-07 | Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6 |
CVE-2024-28222 | Critical | 9.8 | 2024-03-07 | In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated atta… |
CVE-2024-28151 | Medium | 4.3 | 2024-03-06 | Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing a… |
CVE-2024-27765 | High | 7.5 | 2024-03-05 | Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController componen… |
CVE-2024-27764 | Critical | 9.8 | 2024-03-05 | An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. |
CVE-2024-25614 | Medium | 5.5 | 2024-03-05 | There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete ar… |
CVE-2024-25164 | High | 7.5 | 2024-03-05 | iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality. |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-28088 | High | 8.1 | 2024-03-04 | LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypa… |
CVE-2024-24307 | High | 7.5 | 2024-03-03 | Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to esca… |
CVE-2024-25386 | High | 8.8 | 2024-03-01 | Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the f… |
CVE-2023-38366 | Medium | 5.3 | 2024-03-01 | IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could se… |
CVE-2024-2045 | Medium | 5.5 | 2024-03-01 | Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible becau… |
CVE-2024-25830 | Critical | 9.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can explo… |
CVE-2024-25065 | Critical | 9.1 | 2024-02-29 | Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2024-25006 | High | 8.1 | 2024-02-29 | XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive… |
CVE-2024-23946 | Medium | 5.3 | 2024-02-29 | Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2023-7207 | Medium | 4.9 | 2024-02-29 | Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absol… |
CVE-2024-25859 | High | 7.1 | 2024-02-28 | A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code. |
CVE-2024-22723 | Medium | 4.9 | 2024-02-28 | Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can… |
CVE-2024-0763 | High | 8.1 | 2024-02-27 | Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need acces… |
CVE-2024-25711 | High | 7.5 | 2024-02-27 | diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an a… |
CVE-2024-27081 | High | 7.2 | 2024-02-26 | ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version… |
CVE-2024-1886 | Low | 3.0 | 2024-02-26 | This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage. |
CVE-2024-1165 | Medium | 4.3 | 2024-02-26 | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it pos… |
CVE-2023-49960 | High | 7.5 | 2024-02-26 | In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to… |
CVE-2024-27318 | High | 7.5 | 2024-02-23 | Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path t… |
CVE-2024-26150 | High | 8.7 | 2024-02-23 | `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backe… |
CVE-2023-24416 | Medium | 6.8 | 2024-02-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One F… |
CVE-2022-25377 | High | 7.5 | 2024-02-22 | The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. I… |
CVE-2024-25461 | High | 7.5 | 2024-02-21 | Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information via a crafted requ… |
CVE-2024-1704 | Medium | 5.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /admi… |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2024-1708 | High | 8.4 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or di… |