CWE-22 · Path Traversal (page 49)
Page 49 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0593 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outsi… |
CVE-2023-0592 | Medium | 5.5 | 2023-01-31 | A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outs… |
CVE-2023-0591 | Medium | 5.5 | 2023-01-31 | ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of… |
CVE-2022-39059 | High | 7.5 | 2023-01-31 | ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit… |
CVE-2022-22731 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to cre… |
CVE-2022-0223 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwri… |
CVE-2022-38451 | High | 7.5 | 2023-01-30 | A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary… |
CVE-2022-25936 | High | 7.5 | 2023-01-30 | Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. |
CVE-2022-48285 | High | 7.3 | 2023-01-29 | loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. |
CVE-2022-43979 | Medium | 5.9 | 2023-01-27 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted… |
CVE-2022-39812 | High | 7.5 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitra… |
CVE-2019-25053 | High | 7.5 | 2023-01-27 | A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tr… |
CVE-2021-41143 | High | 7.2 | 2023-01-27 | OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the… |
CVE-2022-2712 | Medium | 6.5 | 2023-01-27 | In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. S… |
CVE-2022-47951 | Medium | 5.7 | 2023-01-26 | An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova befor… |
CVE-2022-41154 | Medium | 6.5 | 2023-01-26 | A directory traversal vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network… |
CVE-2022-40701 | High | 8.1 | 2023-01-26 | A directory traversal vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP reque… |
CVE-2022-39045 | High | 8.8 | 2023-01-26 | A file write vulnerability exists in the httpd upload.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lea… |
CVE-2022-38088 | Medium | 6.5 | 2023-01-26 | A directory traversal vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP requ… |
CVE-2023-24455 | Medium | 4.3 | 2023-01-26 | Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configur… |
CVE-2023-24449 | Medium | 4.3 | 2023-01-26 | Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Over… |
CVE-2023-24057 | High | 8.1 | 2023-01-26 | HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP o… |
CVE-2023-23608 | Unrated | | 2023-01-26 | Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be… |
CVE-2022-4510 | High | 7.8 | 2023-01-26 | A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, a… |
CVE-2022-43864 | High | 7.5 | 2023-01-26 | IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2022-31706 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |
CVE-2022-29844 | Medium | 6.7 | 2023-01-26 | A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write ar… |
CVE-2022-25882 | High | 7.5 | 2023-01-26 | Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file whi… |
CVE-2022-21192 | High | 7.5 | 2023-01-26 | All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the… |
CVE-2020-18331 | Critical | 9.1 | 2023-01-26 | Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C… |
CVE-2020-18330 | Critical | 9.1 | 2023-01-26 | An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware p… |
CVE-2022-46639 | High | 7.5 | 2023-01-23 | A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal. |
CVE-2023-23314 | High | 8.8 | 2023-01-23 | An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file. |
CVE-2022-46959 | Medium | 4.3 | 2023-01-23 | An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal. |
CVE-2023-22726 | High | 8.0 | 2023-01-20 | act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inp… |
CVE-2022-47747 | High | 7.5 | 2023-01-20 | kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs. |
CVE-2021-37500 | High | 8.1 | 2023-01-20 | Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficie… |
CVE-2023-0126 | High | 7.5 | 2023-01-19 | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and dire… |
CVE-2023-0290 | Medium | 4.3 | 2023-01-18 | Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task… |
CVE-2020-36651 | Medium | 5.5 | 2023-01-18 | A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file no… |
CVE-2022-43975 | High | 7.5 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbi… |
CVE-2022-2893 | High | 8.2 | 2023-01-17 | RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files… |
CVE-2014-125080 | Medium | 5.5 | 2023-01-16 | A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path… |
CVE-2016-15019 | Medium | 4.3 | 2023-01-15 | A vulnerability was found in tombh jekbox. It has been rated as problematic. This issue affects some unknown processing of the file lib/server.rb. The manipula… |
CVE-2015-10043 | Medium | 5.5 | 2023-01-14 | A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to pat… |
CVE-2022-41956 | Medium | 6.5 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-23532 | High | 7.1 | 2023-01-14 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in… |
CVE-2022-45299 | Critical | 9.8 | 2023-01-13 | An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. |
CVE-2022-42136 | High | 8.8 | 2023-01-13 | Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access… |
CVE-2022-3693 | High | 7.5 | 2023-01-13 | Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System… |
CVE-2022-3782 | Critical | 9.1 | 2023-01-13 | keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker ca… |
CVE-2022-42287 | Medium | 6.0 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which ma… |
CVE-2022-42282 | Medium | 6.5 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure. |
CVE-2022-42280 | High | 7.1 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication by… |
CVE-2022-4885 | Medium | 5.0 | 2023-01-11 | A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jeffer… |
CVE-2022-48253 | Critical | 9.8 | 2023-01-11 | nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerabilit… |
CVE-2022-4636 | High | 7.5 | 2023-01-10 | Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which… |
CVE-2016-15017 | Medium | 5.5 | 2023-01-10 | A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the… |
CVE-2022-45093 | High | 8.5 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-45092 | Critical | 9.9 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-43514 | High | 7.7 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2023-22320 | High | 7.5 | 2023-01-10 | OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Fu… |
CVE-2022-36928 | Medium | 6.1 | 2023-01-09 | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to… |
CVE-2022-4884 | Low | 3.5 | 2023-01-09 | Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious m… |
CVE-2014-125069 | Medium | 4.3 | 2023-01-08 | A vulnerability was found in saxman maps-js-icoads. It has been classified as problematic. Affected is an unknown function. The manipulation leads to exposure… |
CVE-2014-125068 | Medium | 5.5 | 2023-01-08 | A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manip… |
CVE-2020-36647 | Medium | 5.5 | 2023-01-08 | A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manip… |
CVE-2015-10030 | Medium | 5.5 | 2023-01-08 | A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php… |
CVE-2022-4880 | Medium | 5.5 | 2023-01-07 | A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Class… |
CVE-2015-10024 | Medium | 5.5 | 2023-01-07 | A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. Th… |
CVE-2019-25099 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the… |
CVE-2022-4878 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of th… |
CVE-2019-25098 | Medium | 5.5 | 2023-01-05 | A vulnerability was found in soerennb eXtplorer up to 2.1.12. It has been classified as critical. This affects an unknown part of the file include/archive.php… |
CVE-2019-25097 | Medium | 5.5 | 2023-01-05 | A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component… |
CVE-2022-37934 | Medium | 6.8 | 2023-01-05 | A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allo… |
CVE-2020-36639 | Medium | 4.3 | 2023-01-04 | A vulnerability has been found in AlliedModders AMX Mod X on Windows and classified as critical. This vulnerability affects the function cmdVoteMap of the file… |
CVE-2022-38723 | High | 8.6 | 2023-01-03 | Gravitee API Management before 3.15.13 allows path traversal through HTML injection. |
CVE-2022-36943 | High | 8.1 | 2023-01-03 | SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will… |
CVE-2022-45867 | High | 7.2 | 2023-01-03 | MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inc… |
CVE-2022-46309 | Medium | 6.5 | 2023-01-03 | Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary… |
CVE-2022-46306 | High | 8.8 | 2023-01-03 | ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticate… |
CVE-2022-46305 | Medium | 6.5 | 2023-01-03 | ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass authentication and… |
CVE-2022-39040 | High | 7.5 | 2023-01-03 | aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication… |
CVE-2014-125033 | Low | 3.5 | 2023-01-02 | A vulnerability was found in rails-cv-app. It has been rated as problematic. Affected by this issue is some unknown functionality of the file app/controllers/u… |
CVE-2017-20152 | Low | 3.1 | 2022-12-30 | A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the comp… |
CVE-2018-25059 | Low | 3.5 | 2022-12-30 | A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. T… |
CVE-2022-38205 | High | 8.6 | 2022-12-29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker… |
CVE-2022-46178 | High | 7.4 | 2022-12-29 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-4779 | High | 7.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme. StreamX applicat… |
CVE-2022-4778 | Medium | 6.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access… |
CVE-2022-44564 | High | 7.8 | 2022-12-28 | Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources. |
CVE-2022-38202 | High | 7.5 | 2022-12-28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker t… |
CVE-2022-4773 | Low | 2.5 | 2022-12-28 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the… |
CVE-2022-4772 | Medium | 4.5 | 2022-12-27 | A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.jav… |
CVE-2020-36566 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36561 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36560 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36559 | High | 7.5 | 2022-12-27 | Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target director… |
CVE-2019-25073 | High | 7.5 | 2022-12-27 | Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory. |
CVE-2018-25046 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |