CWE-22 · Path Traversal (page 48)
Page 48 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1177 | Critical | 9.3 | 2023-03-24 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2023-26361 | Medium | 4.9 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Dir… |
CVE-2023-20066 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that… |
CVE-2018-25048 | High | 8.8 | 2023-03-23 | The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system… |
CVE-2023-25688 | Medium | 4.3 | 2023-03-22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker cou… |
CVE-2023-27856 | High | 7.5 | 2023-03-22 | In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remo… |
CVE-2023-27855 | Critical | 9.8 | 2023-03-22 | In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker co… |
CVE-2023-25689 | Low | 2.7 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker c… |
CVE-2023-27981 | High | 7.8 | 2023-03-21 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a vi… |
CVE-2023-1467 | Medium | 6.5 | 2023-03-17 | A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the… |
CVE-2023-21456 | Critical | 9.0 | 2023-03-16 | Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid. |
CVE-2023-28105 | High | 8.8 | 2023-03-16 | go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use… |
CVE-2023-25345 | High | 7.5 | 2023-03-15 | Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags. |
CVE-2023-25804 | High | 7.5 | 2023-03-15 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability… |
CVE-2023-28371 | Critical | 9.8 | 2023-03-15 | In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal. |
CVE-2023-27588 | High | 7.5 | 2023-03-14 | Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prio… |
CVE-2023-1398 | Medium | 6.3 | 2023-03-14 | A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload… |
CVE-2022-47595 | Medium | 4.9 | 2023-03-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions. |
CVE-2023-27501 | High | 8.7 | 2023-03-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insu… |
CVE-2023-27500 | Critical | 9.6 | 2023-03-14 | An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no da… |
CVE-2023-27269 | Critical | 9.6 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker… |
CVE-2023-25803 | High | 7.5 | 2023-03-13 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that… |
CVE-2023-25802 | High | 7.5 | 2023-03-13 | Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename`… |
CVE-2022-31474 | High | 7.5 | 2023-03-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects Ba… |
CVE-2023-27577 | Medium | 6.6 | 2023-03-10 | flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may… |
CVE-2023-25814 | High | 7.1 | 2023-03-09 | metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations… |
CVE-2021-33353 | Critical | 9.8 | 2023-03-08 | Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via th… |
CVE-2023-23760 | Medium | 4.9 | 2023-03-08 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2023-27475 | High | 8.8 | 2023-03-07 | Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a mal… |
CVE-2022-42476 | High | 8.2 | 2023-03-07 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2… |
CVE-2022-41328 | Medium | 6.7 | 2023-03-07 | A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0… |
CVE-2017-20181 | Medium | 5.3 | 2023-03-07 | A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android. This vulnerability affects unknown code of the file src/at/… |
CVE-2023-25304 | High | 7.8 | 2023-03-06 | An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file. |
CVE-2023-1191 | Medium | 4.7 | 2023-03-06 | A vulnerability classified as problematic has been found in fastcms. This affects an unknown part of the file admin/TemplateController.java of the component ZI… |
CVE-2023-26111 | High | 7.5 | 2023-03-06 | All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path… |
CVE-2023-22336 | Critical | 9.8 | 2023-03-06 | Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially… |
CVE-2023-1163 | Medium | 6.5 | 2023-03-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability… |
CVE-2020-5001 | Medium | 4.3 | 2023-03-01 | IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-… |
CVE-2022-3162 | Medium | 6.5 | 2023-03-01 | Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group witho… |
CVE-2023-1112 | Medium | 4.7 | 2023-03-01 | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown… |
CVE-2023-22776 | Medium | 4.9 | 2023-03-01 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the abilit… |
CVE-2023-22774 | High | 7.2 | 2023-03-01 | Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abilit… |
CVE-2023-22773 | High | 7.2 | 2023-03-01 | Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abilit… |
CVE-2023-22772 | Medium | 6.5 | 2023-03-01 | An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in th… |
CVE-2022-41722 | High | 7.5 | 2023-02-28 | A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b"… |
CVE-2023-20943 | High | 7.8 | 2023-02-28 | In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. This could lead to lo… |
CVE-2023-0511 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java… |
CVE-2023-0339 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Po… |
CVE-2023-26256 | High | 7.5 | 2023-02-28 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileNa… |
CVE-2023-26255 | High | 7.5 | 2023-02-28 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileNa… |
CVE-2023-25265 | High | 7.5 | 2023-02-28 | Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system. |
CVE-2023-26758 | High | 7.5 | 2023-02-27 | Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService. |
CVE-2023-1045 | Low | 3.8 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accesso… |
CVE-2023-1044 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/i… |
CVE-2023-1043 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulatio… |
CVE-2022-48362 | High | 8.8 | 2023-02-25 | Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, aut… |
CVE-2023-1009 | Medium | 6.5 | 2023-02-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14… |
CVE-2023-1002 | Medium | 4.3 | 2023-02-24 | A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The mani… |
CVE-2023-22973 | High | 8.8 | 2023-02-22 | A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname… |
CVE-2023-0104 | Critical | 9.3 | 2023-02-22 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker… |
CVE-2023-25579 | Medium | 6.0 | 2023-02-22 | Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing th… |
CVE-2023-23063 | High | 7.5 | 2023-02-22 | Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. |
CVE-2022-41216 | High | 8.3 | 2023-02-22 | Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system. |
CVE-2023-0947 | Critical | 9.8 | 2023-02-22 | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-26265 | Medium | 5.3 | 2023-02-21 | The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in… |
CVE-2023-24960 | High | 7.5 | 2023-02-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL requ… |
CVE-2022-44299 | Medium | 4.9 | 2023-02-16 | SiteServerCMS 7.1.3 sscms has a file read vulnerability. |
CVE-2023-22380 | Medium | 6.5 | 2023-02-16 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2022-33892 | High | 7.3 | 2023-02-16 | Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-23784 | Medium | 5.7 | 2023-02-16 | A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to… |
CVE-2023-23778 | Medium | 4.9 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authent… |
CVE-2022-41335 | High | 8.8 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2… |
CVE-2022-30300 | Medium | 6.5 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to… |
CVE-2022-30299 | Medium | 5.3 | 2023-02-16 | A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions… |
CVE-2022-38731 | Medium | 4.3 | 2023-02-16 | Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on t… |
CVE-2023-0862 | High | 7.2 | 2023-02-16 | The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicio… |
CVE-2022-47506 | High | 7.8 | 2023-02-15 | SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to… |
CVE-2023-23946 | Medium | 6.2 | 2023-02-14 | Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2… |
CVE-2023-22629 | High | 8.8 | 2023-02-14 | An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated att… |
CVE-2023-24188 | Critical | 9.1 | 2023-02-13 | ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted. |
CVE-2023-24804 | Medium | 5.0 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path tra… |
CVE-2022-48323 | Critical | 9.8 | 2023-02-13 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker ca… |
CVE-2022-25937 | Medium | 6.5 | 2023-02-13 | Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is re… |
CVE-2023-24689 | Medium | 4.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the… |
CVE-2023-21448 | Medium | 5.7 | 2023-02-09 | Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file. |
CVE-2023-24815 | Medium | 4.8 | 2023-02-09 | Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files usi… |
CVE-2023-0745 | Medium | 6.7 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoin… |
CVE-2021-36471 | Critical | 9.8 | 2023-02-07 | Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html… |
CVE-2022-47762 | High | 7.5 | 2023-02-03 | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability. |
CVE-2021-37317 | Critical | 9.1 | 2023-02-03 | Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary fi… |
CVE-2021-36425 | Medium | 5.4 | 2023-02-03 | Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include… |
CVE-2022-3560 | Medium | 5.5 | 2023-02-02 | A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc… |
CVE-2022-45783 | Medium | 6.5 | 2023-02-01 | An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execut… |
CVE-2023-23136 | Medium | 6.5 | 2023-02-01 | lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php. |
CVE-2023-0454 | High | 8.1 | 2023-02-01 | OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application… |
CVE-2022-47768 | High | 7.5 | 2023-02-01 | Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal. |
CVE-2016-15023 | Low | 3.5 | 2023-01-31 | A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getexten… |
CVE-2022-46835 | High | 8.8 | 2023-01-31 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior t… |