CWE-22 · Path Traversal (page 51)
Page 51 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36400 | Medium | 6.7 | 2022-11-11 | Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user… |
CVE-2022-3940 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulat… |
CVE-2022-3939 | Medium | 6.3 | 2022-11-11 | A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/publ… |
CVE-2022-41607 | Medium | 6.2 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through… |
CVE-2022-43753 | Medium | 4.3 | 2022-11-10 | A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Mana… |
CVE-2022-39037 | High | 7.5 | 2022-11-10 | Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentica… |
CVE-2022-38120 | Medium | 6.5 | 2022-11-10 | UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and acce… |
CVE-2022-31255 | Medium | 4.3 | 2022-11-10 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Man… |
CVE-2022-29836 | Low | 1.9 | 2022-11-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; M… |
CVE-2022-41212 | Medium | 4.9 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-34822 | Critical | 9.8 | 2022-11-08 | Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for W… |
CVE-2022-20453 | Medium | 5.5 | 2022-11-08 | In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. This could lead to local denial of serv… |
CVE-2022-37866 | High | 7.5 | 2022-11-07 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders… |
CVE-2022-37865 | Critical | 9.1 | 2022-11-07 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging… |
CVE-2022-2711 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privil… |
CVE-2020-12509 | High | 7.5 | 2022-11-07 | In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module. |
CVE-2022-20962 | Low | 3.8 | 2022-11-04 | A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized… |
CVE-2022-41670 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversari… |
CVE-2022-41667 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privilege… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-32287 | High | 7.5 | 2022-11-03 | A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the… |
CVE-2021-45448 | High | 7.1 | 2022-11-02 | Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allow… |
CVE-2022-32938 | Medium | 5.3 | 2022-11-01 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13… |
CVE-2022-34662 | Medium | 6.5 | 2022-11-01 | When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to versio… |
CVE-2022-41772 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traver… |
CVE-2022-41657 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operati… |
CVE-2021-40661 | High | 7.5 | 2022-10-31 | A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 Ma… |
CVE-2022-40742 | Medium | 6.5 | 2022-10-31 | Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP fil… |
CVE-2022-39023 | Medium | 6.5 | 2022-10-31 | U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download a… |
CVE-2022-39022 | Medium | 6.5 | 2022-10-31 | U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download a… |
CVE-2022-39367 | High | 8.6 | 2022-10-28 | QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packa… |
CVE-2022-26884 | Medium | 6.5 | 2022-10-28 | Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher. |
CVE-2021-38399 | High | 7.5 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized fil… |
CVE-2022-3387 | Medium | 6.5 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to… |
CVE-2022-0072 | Medium | 5.8 | 2022-10-27 | Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects ve… |
CVE-2022-20955 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20954 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20953 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20822 | High | 7.1 | 2022-10-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete… |
CVE-2022-20811 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20776 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-43748 | Medium | 5.8 | 2022-10-26 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before… |
CVE-2022-39345 | Critical | 9.8 | 2022-10-25 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vuln… |
CVE-2022-38196 | Medium | 6.5 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated att… |
CVE-2022-33897 | Critical | 9.1 | 2022-10-25 | A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead… |
CVE-2022-41780 | Medium | 5.5 | 2022-10-19 | In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI t… |
CVE-2022-42188 | High | 7.5 | 2022-10-18 | In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. |
CVE-2022-39058 | High | 7.5 | 2022-10-18 | RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentica… |
CVE-2022-22245 | Medium | 4.3 | 2022-10-18 | A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by… |
CVE-2022-3060 | High | 7.3 | 2022-10-17 | Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate conte… |
CVE-2022-23770 | High | 8.8 | 2022-10-17 | This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attacker… |
CVE-2022-22128 | Critical | 9.8 | 2022-10-17 | Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code e… |
CVE-2022-38424 | High | 7.2 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('P… |
CVE-2022-38423 | Medium | 4.9 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('P… |
CVE-2022-38422 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('P… |
CVE-2022-38421 | High | 7.2 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('P… |
CVE-2022-38418 | Critical | 9.8 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('P… |
CVE-2021-22685 | Medium | 6.2 | 2022-10-14 | An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1. |
CVE-2021-20030 | High | 7.5 | 2022-10-13 | SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containing application's bina… |
CVE-2022-33937 | High | 7.1 | 2022-10-12 | Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit… |
CVE-2022-39802 | High | 7.5 | 2022-10-11 | SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended f… |
CVE-2022-39296 | High | 8.6 | 2022-10-11 | MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versio… |
CVE-2022-34430 | High | 7.1 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-34426 | High | 8.8 | 2022-10-11 | Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to… |
CVE-2022-2554 | Medium | 4.9 | 2022-10-10 | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege user… |
CVE-2022-39858 | High | 7.3 | 2022-10-07 | Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privileg… |
CVE-2022-3389 | High | 7.5 | 2022-10-06 | Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10. |
CVE-2022-42308 | Critical | 9.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a… |
CVE-2022-42305 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal atta… |
CVE-2022-40123 | Medium | 6.5 | 2022-10-03 | mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authen… |
CVE-2022-34429 | Medium | 6.5 | 2022-09-30 | Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-20850 | Medium | 5.5 | 2022-09-30 | A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitra… |
CVE-2022-20818 | High | 7.8 | 2022-09-30 | Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities ar… |
CVE-2022-20775 | High | 7.8 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to i… |
CVE-2021-33354 | High | 8.1 | 2022-09-30 | Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter. |
CVE-2022-2922 | Medium | 4.9 | 2022-09-30 | Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. |
CVE-2022-40082 | High | 7.5 | 2022-09-28 | Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function. |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2022-28814 | Critical | 9.8 | 2022-09-28 | Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability w… |
CVE-2022-39034 | Medium | 6.5 | 2022-09-28 | Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker wit… |
CVE-2022-39033 | Critical | 9.8 | 2022-09-28 | Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unau… |
CVE-2022-40199 | Low | 2.7 | 2022-09-27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated… |
CVE-2022-2926 | Medium | 4.9 | 2022-09-26 | The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and rea… |
CVE-2022-41352 | Critical | 9.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to… |
CVE-2022-34026 | High | 7.5 | 2022-09-22 | ICEcoder v8.1 allows attackers to execute a directory traversal. |
CVE-2022-40444 | Medium | 5.3 | 2022-09-22 | ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server. |
CVE-2022-40443 | Medium | 5.3 | 2022-09-22 | An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php. |
CVE-2022-28981 | High | 7.5 | 2022-09-22 | Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.li… |
CVE-2022-29799 | Medium | 5.5 | 2022-09-21 | A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of net… |
CVE-2022-41231 | Medium | 5.7 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins control… |
CVE-2022-2265 | High | 7.5 | 2022-09-21 | The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability… |
CVE-2022-39221 | High | 7.5 | 2022-09-21 | McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt… |
CVE-2022-38340 | Critical | 9.1 | 2022-09-20 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. |
CVE-2022-23767 | High | 8.8 | 2022-09-19 | This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An atta… |
CVE-2022-40608 | High | 7.5 | 2022-09-19 | IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL w… |
CVE-2022-40715 | Medium | 6.5 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. An Absolute Path Traversal vulnerability exists for a specific endpoint via the logfile parameter, allowing a r… |
CVE-2022-40713 | Medium | 6.5 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. Multiple Relative Path Traversal issues exist in different specific endpoints via the file parameter, allowing… |
CVE-2022-37700 | High | 7.5 | 2022-09-19 | Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.ze… |
CVE-2022-39210 | Low | 3.2 | 2022-09-17 | Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly pro… |
CVE-2022-39001 | High | 7.5 | 2022-09-16 | The number identification module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause data disclosure. |