CWE-22 · Path Traversal (page 47)
Page 47 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30507 | Medium | 4.9 | 2023-05-16 | Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulner… |
CVE-2023-2196 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-spe… |
CVE-2023-32985 | Medium | 4.3 | 2023-05-16 | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Rea… |
CVE-2023-31131 | High | 7.4 | 2023-05-15 | Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extrac… |
CVE-2023-32309 | High | 7.5 | 2023-05-15 | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using includ… |
CVE-2023-23169 | Medium | 6.5 | 2023-05-12 | Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. |
CVE-2020-13377 | High | 8.1 | 2023-05-12 | The web-services interface of Loadbalancer.org Enterprise VA MAX through 8.3.8 could allow an authenticated, remote, low-privileged attacker to conduct directo… |
CVE-2023-31477 | High | 7.5 | 2023-05-11 | A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such a… |
CVE-2023-30172 | High | 7.5 | 2023-05-11 | A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server… |
CVE-2023-29986 | Medium | 5.3 | 2023-05-11 | spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view. |
CVE-2023-31166 | Medium | 4.1 | 2023-05-10 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation… |
CVE-2023-27562 | Medium | 6.5 | 2023-05-10 | The n8n package 0.218.0 for Node.js allows Directory Traversal. |
CVE-2022-34855 | Medium | 6.7 | 2023-05-10 | Path traversal for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-26126 | High | 7.5 | 2023-05-10 | All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile f… |
CVE-2023-28127 | High | 7.5 | 2023-05-09 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. |
CVE-2023-20098 | Medium | 4.4 | 2023-05-09 | A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due… |
CVE-2023-29128 | Low | 3.8 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-29104 | Medium | 6.0 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-27409 | Low | 2.5 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vulnerability was found in the `deviceinfo` binary via the `mac… |
CVE-2023-31181 | High | 7.5 | 2023-05-08 | WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - CWE-22: Path Traversal |
CVE-2023-31179 | Medium | 6.5 | 2023-05-08 | AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request. |
CVE-2023-30855 | Medium | 6.5 | 2023-05-08 | Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this pa… |
CVE-2023-32235 | High | 7.5 | 2023-05-05 | Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This… |
CVE-2023-25289 | High | 7.5 | 2023-05-04 | Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attack… |
CVE-2023-30268 | Critical | 9.8 | 2023-05-04 | CLTPHP <=6.0 is vulnerable to Improper Input Validation. |
CVE-2017-20184 | High | 7.5 | 2023-05-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthe… |
CVE-2022-47757 | Critical | 9.8 | 2023-05-04 | In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's d… |
CVE-2023-27993 | Medium | 6.0 | 2023-05-03 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the un… |
CVE-2023-28406 | Medium | 4.3 | 2023-05-03 | A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files w… |
CVE-2022-47875 | High | 8.8 | 2023-05-02 | A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code. |
CVE-2022-48483 | High | 7.5 | 2023-05-02 | 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory tra… |
CVE-2022-48482 | High | 7.5 | 2023-05-02 | 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directo… |
CVE-2015-10105 | Medium | 6.3 | 2023-05-01 | A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifie… |
CVE-2023-31483 | High | 7.5 | 2023-04-28 | tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files… |
CVE-2023-30380 | High | 7.5 | 2023-04-27 | An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal. |
CVE-2023-30852 | Medium | 4.4 | 2023-04-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by… |
CVE-2023-2336 | Medium | 6.5 | 2023-04-27 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-24836 | High | 8.8 | 2023-04-27 | SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit th… |
CVE-2023-22901 | Medium | 4.9 | 2023-04-27 | ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary… |
CVE-2023-26243 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware f… |
CVE-2023-30265 | Medium | 6.5 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Directory Traversal. |
CVE-2023-2273 | Medium | 5.8 | 2023-04-26 | Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flow… |
CVE-2023-25815 | Low | 3.3 | 2023-04-25 | In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages a… |
CVE-2023-25652 | High | 7.5 | 2023-04-25 | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding spec… |
CVE-2023-29200 | Medium | 4.3 | 2023-04-25 | Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file m… |
CVE-2023-23838 | Medium | 6.5 | 2023-04-25 | Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. |
CVE-2023-27105 | Critical | 9.8 | 2023-04-25 | A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player wit… |
CVE-2023-30626 | High | 8.8 | 2023-04-24 | Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `Cli… |
CVE-2023-22914 | High | 7.2 | 2023-04-24 | A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware ver… |
CVE-2022-48476 | High | 7.5 | 2023-04-24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible |
CVE-2023-31059 | High | 7.5 | 2023-04-24 | Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. |
CVE-2023-25508 | Medium | 6.7 | 2023-04-22 | NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary… |
CVE-2023-30620 | High | 7.5 | 2023-04-21 | mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extra… |
CVE-2023-26101 | High | 7.5 | 2023-04-21 | In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability… |
CVE-2023-28459 | Medium | 6.5 | 2023-04-20 | pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the read… |
CVE-2023-28458 | Medium | 4.3 | 2023-04-20 | pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404… |
CVE-2023-21093 | High | 7.8 | 2023-04-19 | In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a path traversal error… |
CVE-2023-29887 | High | 7.5 | 2023-04-18 | A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. |
CVE-2023-30548 | Medium | 4.3 | 2023-04-17 | gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin pr… |
CVE-2023-29004 | Medium | 6.5 | 2023-04-17 | hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version o… |
CVE-2023-1109 | High | 8.8 | 2023-04-17 | In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file… |
CVE-2022-34127 | High | 7.5 | 2023-04-16 | The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. |
CVE-2022-34126 | High | 7.5 | 2023-04-16 | The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2023-26559 | Medium | 5.3 | 2023-04-14 | A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an… |
CVE-2023-27648 | Critical | 9.8 | 2023-04-14 | Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex fil… |
CVE-2022-47027 | Critical | 9.8 | 2023-04-14 | Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnera… |
CVE-2023-26969 | High | 7.5 | 2023-04-14 | Atropim 1.5.26 is vulnerable to Directory Traversal. |
CVE-2023-27812 | Critical | 9.1 | 2023-04-13 | bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function. |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2023-26293 | High | 7.3 | 2023-04-11 | A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal)… |
CVE-2023-29186 | High | 8.7 | 2023-04-11 | In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on… |
CVE-2023-1478 | Critical | 9.8 | 2023-04-10 | The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal v… |
CVE-2023-0156 | Medium | 4.9 | 2023-04-10 | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admi… |
CVE-2023-27603 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a p… |
CVE-2023-1956 | Medium | 5.4 | 2023-04-08 | A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2023-29478 | Critical | 9.8 | 2023-04-07 | BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This… |
CVE-2023-26820 | High | 7.5 | 2023-04-07 | siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js. |
CVE-2020-19678 | High | 7.5 | 2023-04-06 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information vi… |
CVE-2023-20129 | Medium | 6.5 | 2023-04-05 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow… |
CVE-2020-19279 | Critical | 9.8 | 2023-04-04 | Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links. |
CVE-2023-25305 | High | 7.1 | 2023-04-04 | PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation d… |
CVE-2023-25303 | High | 7.1 | 2023-04-04 | ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation dir… |
CVE-2022-43771 | Medium | 6.5 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service… |
CVE-2023-27534 | High | 8.8 | 2023-03-30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the fir… |
CVE-2023-28833 | Low | 2.4 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a… |
CVE-2022-23522 | High | 8.5 | 2023-03-30 | MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely retrieved tarball… |
CVE-2023-28732 | Medium | 6.5 | 2023-03-30 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system… |
CVE-2022-36982 | High | 7.5 | 2023-03-29 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required… |
CVE-2022-36981 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is requir… |
CVE-2022-2560 | Critical | 9.1 | 2023-03-29 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Authentication is not… |
CVE-2023-27700 | High | 8.1 | 2023-03-28 | MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /accessory/picdel.html. |
CVE-2022-48361 | Medium | 5.3 | 2023-03-27 | The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD… |
CVE-2023-0241 | Medium | 6.5 | 2023-03-27 | pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database. |
CVE-2023-0467 | Medium | 4.3 | 2023-03-27 | The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads… |
CVE-2023-1142 | High | 7.5 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass aut… |
CVE-2023-1134 | High | 7.1 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local… |
CVE-2022-32199 | Medium | 6.5 | 2023-03-27 | db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. |
CVE-2023-26802 | Critical | 9.8 | 2023-03-26 | An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execu… |
CVE-2023-27055 | High | 7.5 | 2023-03-24 | Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request. |