CWE-22 · Path Traversal (page 50)
Page 50 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4748 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/… |
CVE-2019-25087 | Medium | 5.3 | 2022-12-27 | A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/Resou… |
CVE-2021-39369 | Medium | 6.5 | 2022-12-26 | In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored… |
CVE-2020-36629 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The… |
CVE-2020-36628 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/a… |
CVE-2022-45894 | Medium | 6.5 | 2022-12-25 | GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files. |
CVE-2022-44016 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_A… |
CVE-2022-47945 | Critical | 9.8 | 2022-12-23 | ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthe… |
CVE-2022-23854 | High | 7.5 | 2022-12-23 | AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network acces… |
CVE-2022-46171 | Medium | 6.8 | 2022-12-23 | Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literal… |
CVE-2022-46492 | Medium | 6.5 | 2022-12-23 | nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary. |
CVE-2022-43858 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using… |
CVE-2022-43857 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this… |
CVE-2022-3184 | Critical | 9.8 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an o… |
CVE-2022-36221 | Medium | 6.5 | 2022-12-21 | Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system. |
CVE-2022-25895 | High | 7.5 | 2022-12-21 | All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url use… |
CVE-2022-41591 | High | 7.5 | 2022-12-20 | The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files. |
CVE-2021-46856 | High | 7.5 | 2022-12-20 | The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-25931 | High | 7.5 | 2022-12-20 | All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url… |
CVE-2022-41418 | High | 7.2 | 2022-12-19 | An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via u… |
CVE-2022-40607 | Medium | 6.8 | 2022-12-19 | IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside… |
CVE-2022-4063 | Critical | 9.8 | 2022-12-19 | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusio… |
CVE-2022-4594 | Medium | 6.3 | 2022-12-18 | A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/ro… |
CVE-2022-4583 | Medium | 6.3 | 2022-12-17 | A vulnerability was found in jLEMS. It has been declared as critical. Affected by this vulnerability is the function unpackJar of the file src/main/java/org/le… |
CVE-2022-4572 | Medium | 5.4 | 2022-12-17 | A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files… |
CVE-2022-23531 | Medium | 5.8 | 2022-12-17 | GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted… |
CVE-2022-23530 | Medium | 5.8 | 2022-12-16 | GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted r… |
CVE-2022-46137 | High | 7.5 | 2022-12-16 | AeroCMS v0.0.1 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: AeroCMS v0.0.1. |
CVE-2022-20505 | Medium | 6.7 | 2022-12-16 | In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with… |
CVE-2022-45969 | Critical | 9.8 | 2022-12-15 | Alist v3.4.0 is vulnerable to Directory Traversal, |
CVE-2022-4511 | Medium | 5.3 | 2022-12-15 | A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.D… |
CVE-2020-24855 | Medium | 5.3 | 2022-12-15 | Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request. |
CVE-2022-32573 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request ca… |
CVE-2022-29517 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP r… |
CVE-2022-29511 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-cra… |
CVE-2022-27498 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially… |
CVE-2022-31703 | High | 7.5 | 2022-12-14 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |
CVE-2022-46256 | High | 8.8 | 2022-12-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2022-46255 | Critical | 9.8 | 2022-12-14 | An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A c… |
CVE-2022-23512 | High | 7.7 | 2022-12-14 | MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFi… |
CVE-2022-4494 | Medium | 6.3 | 2022-12-14 | A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src… |
CVE-2022-4493 | Medium | 6.3 | 2022-12-14 | A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/… |
CVE-2022-34271 | High | 8.8 | 2022-12-14 | A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from… |
CVE-2022-40264 | Medium | 6.3 | 2022-12-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2… |
CVE-2022-20449 | Medium | 4.4 | 2022-12-13 | In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. This could lead to… |
CVE-2022-29580 | High | 8.9 | 2022-12-13 | There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encod… |
CVE-2022-45269 | High | 7.5 | 2022-12-12 | A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files. |
CVE-2022-44653 | High | 7.8 | 2022-12-12 | A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on aff… |
CVE-2022-44532 | Medium | 4.9 | 2022-12-12 | An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability… |
CVE-2022-43518 | Medium | 4.9 | 2022-12-12 | An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful exploitation of this vulnerability results i… |
CVE-2022-37906 | Medium | 6.5 | 2022-12-12 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability… |
CVE-2022-4402 | Medium | 4.7 | 2022-12-11 | A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler… |
CVE-2022-45290 | Critical | 9.1 | 2022-12-09 | Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java. |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-4123 | Low | 3.3 | 2022-12-08 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to co… |
CVE-2022-41720 | High | 7.5 | 2022-12-07 | On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a g… |
CVE-2020-36565 | Medium | 5.3 | 2022-12-07 | Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of th… |
CVE-2022-44942 | High | 8.1 | 2022-12-07 | Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. |
CVE-2022-45833 | Medium | 6.8 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-45829 | High | 8.7 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress. |
CVE-2022-44900 | Critical | 9.1 | 2022-12-06 | A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitra… |
CVE-2022-46154 | High | 8.6 | 2022-12-06 | Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from reque… |
CVE-2022-23470 | High | 8.6 | 2022-12-06 | Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be… |
CVE-2022-42706 | Medium | 4.9 | 2022-12-05 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk… |
CVE-2022-2969 | High | 8.1 | 2022-12-01 | Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory l… |
CVE-2022-29837 | Medium | 4.7 | 2022-12-01 | A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate inst… |
CVE-2022-4031 | Low | 3.8 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does n… |
CVE-2022-4030 | High | 8.1 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated d… |
CVE-2022-3361 | Medium | 4.3 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on th… |
CVE-2022-25848 | High | 7.5 | 2022-11-29 | This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accesse… |
CVE-2022-44635 | High | 8.8 | 2022-11-29 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Finer… |
CVE-2022-45921 | High | 7.5 | 2022-11-28 | FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able… |
CVE-2022-41158 | High | 7.2 | 2022-11-25 | Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vuln… |
CVE-2022-41712 | Medium | 6.5 | 2022-11-25 | Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly valida… |
CVE-2022-40977 | High | 7.5 | 2022-11-24 | A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configurat… |
CVE-2022-40976 | Medium | 5.5 | 2022-11-24 | A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to… |
CVE-2022-44749 | Medium | 5.5 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being over… |
CVE-2022-44748 | High | 7.1 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the s… |
CVE-2022-45866 | Medium | 5.3 | 2022-11-23 | qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp… |
CVE-2022-44280 | Medium | 6.5 | 2022-11-23 | Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img. |
CVE-2022-4065 | Medium | 5.5 | 2022-11-19 | A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlE… |
CVE-2022-41840 | High | 7.5 | 2022-11-18 | Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. |
CVE-2022-39178 | Medium | 5.3 | 2022-11-17 | Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclos… |
CVE-2022-38165 | Critical | 9.8 | 2022-11-17 | Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on t… |
CVE-2022-3090 | High | 7.5 | 2022-11-17 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable… |
CVE-2022-41920 | Medium | 6.3 | 2022-11-17 | Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip… |
CVE-2022-42892 | Medium | 5.3 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-44006 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthentica… |
CVE-2022-44008 | Medium | 6.5 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat s… |
CVE-2022-39347 | Low | 2.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` c… |
CVE-2022-43264 | High | 7.5 | 2022-11-16 | Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web reque… |
CVE-2020-12508 | High | 7.5 | 2022-11-15 | In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the image-relocator module. |
CVE-2022-45388 | High | 7.5 | 2022-11-15 | Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read a… |
CVE-2022-45381 | High | 8.1 | 2022-11-15 | Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Confi… |
CVE-2022-42977 | High | 7.5 | 2022-11-15 | The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During… |
CVE-2022-42125 | High | 7.5 | 2022-11-15 | Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create o… |
CVE-2022-42123 | High | 7.5 | 2022-11-15 | A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19… |
CVE-2022-45184 | High | 7.2 | 2022-11-14 | The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a rem… |
CVE-2022-3976 | Medium | 5.5 | 2022-11-13 | A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/i… |
CVE-2022-3966 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the f… |