CWE-22 · Path Traversal (page 52)
Page 52 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2863 | Medium | 4.9 | 2022-09-16 | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowin… |
CVE-2022-34002 | Medium | 6.5 | 2022-09-16 | The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-pr… |
CVE-2022-39215 | High | 8.3 | 2022-09-15 | Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possib… |
CVE-2022-1798 | High | 8.7 | 2022-09-15 | A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary fil… |
CVE-2022-40734 | Medium | 6.5 | 2022-09-14 | UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited… |
CVE-2022-38301 | High | 8.8 | 2022-09-14 | Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into… |
CVE-2022-36113 | Medium | 4.6 | 2022-09-14 | Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, mak… |
CVE-2022-37703 | Low | 3.3 | 2022-09-13 | In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exist… |
CVE-2022-20395 | High | 7.8 | 2022-09-13 | In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no… |
CVE-2022-32190 | High | 7.5 | 2022-09-13 | JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https… |
CVE-2022-26049 | Medium | 5.3 | 2022-09-11 | This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination director… |
CVE-2022-38638 | Critical | 9.1 | 2022-09-09 | Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. |
CVE-2022-38614 | High | 7.5 | 2022-09-09 | An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PAT… |
CVE-2022-38613 | Medium | 6.5 | 2022-09-09 | A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system. |
CVE-2022-28741 | High | 8.1 | 2022-09-09 | aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validati… |
CVE-2022-37299 | Medium | 6.5 | 2022-09-09 | An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.p… |
CVE-2022-36850 | Medium | 4.0 | 2022-09-09 | Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid. |
CVE-2022-38258 | High | 8.1 | 2022-09-08 | A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information v… |
CVE-2022-36081 | High | 7.5 | 2022-09-07 | Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discl… |
CVE-2022-36065 | High | 7.5 | 2022-09-06 | GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can… |
CVE-2022-2945 | Medium | 4.9 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type'… |
CVE-2022-2943 | Medium | 4.9 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insu… |
CVE-2022-29062 | Medium | 6.3 | 2022-09-06 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesy… |
CVE-2022-39838 | High | 8.6 | 2022-09-05 | Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pat… |
CVE-2022-34378 | Medium | 5.5 | 2022-09-02 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerability. A low priv… |
CVE-2022-25371 | Critical | 9.8 | 2022-09-02 | Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (htt… |
CVE-2022-36593 | Medium | 6.5 | 2022-09-02 | kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java. |
CVE-2022-34373 | High | 7.3 | 2022-08-31 | Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious use… |
CVE-2022-37122 | High | 7.5 | 2022-08-31 | Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrar… |
CVE-2022-36035 | High | 7.7 | 2022-08-31 | Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when ther… |
CVE-2022-34375 | High | 8.8 | 2022-08-30 | Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low pri… |
CVE-2022-37681 | High | 7.5 | 2022-08-29 | Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a… |
CVE-2022-2261 | High | 7.2 | 2022-08-29 | The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, lead… |
CVE-2022-36687 | Medium | 6.5 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img. |
CVE-2022-38794 | High | 7.5 | 2022-08-27 | Zaver through 2020-12-15 allows directory traversal via the GET /.. substring. |
CVE-2021-3856 | Medium | 4.3 | 2022-08-26 | ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme re… |
CVE-2021-3688 | Medium | 4.8 | 2022-08-26 | A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains… |
CVE-2021-40285 | High | 8.1 | 2022-08-26 | htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php. |
CVE-2022-36168 | Low | 2.7 | 2022-08-26 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: |
CVE-2022-2464 | High | 7.7 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an… |
CVE-2022-2463 | Medium | 6.1 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file… |
CVE-2022-32427 | High | 8.8 | 2022-08-25 | PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename… |
CVE-2022-34836 | Medium | 5.9 | 2022-08-24 | Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., fl… |
CVE-2022-35235 | Medium | 4.9 | 2022-08-23 | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. |
CVE-2022-36261 | Critical | 9.1 | 2022-08-23 | An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&c… |
CVE-2022-34486 | High | 7.2 | 2022-08-23 | Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious… |
CVE-2022-30547 | Critical | 9.9 | 2022-08-22 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP req… |
CVE-2022-2557 | High | 8.8 | 2022-08-22 | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path travers… |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |
CVE-2022-37422 | High | 7.5 | 2022-08-18 | Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded. |
CVE-2022-35204 | Medium | 4.3 | 2022-08-18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. |
CVE-2022-37060 | High | 7.5 | 2022-08-18 | FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthentica… |
CVE-2022-1373 | High | 7.2 | 2022-08-17 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files… |
CVE-2021-42052 | High | 7.5 | 2022-08-16 | IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter. |
CVE-2022-34254 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restri… |
CVE-2020-21642 | Critical | 9.8 | 2022-08-15 | Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run… |
CVE-2020-21365 | High | 7.5 | 2022-08-15 | Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted ht… |
CVE-2022-36007 | Medium | 6.1 | 2022-08-15 | Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file… |
CVE-2022-37423 | High | 7.5 | 2022-08-12 | Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream. |
CVE-2022-37042 | Critical | 9.8 | 2022-08-12 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authenticatio… |
CVE-2022-38129 | Critical | 9.8 | 2022-08-10 | A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (S… |
CVE-2022-29804 | High | 7.5 | 2022-08-10 | Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential di… |
CVE-2022-34365 | Medium | 6.5 | 2022-08-10 | WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to th… |
CVE-2022-20816 | Medium | 6.5 | 2022-08-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2022-36831 | Medium | 6.2 | 2022-08-05 | Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission. |
CVE-2022-33715 | Medium | 5.3 | 2022-08-05 | Improper access control and path traversal vulnerability in LauncherProvider prior to SMR Aug-2022 Release 1 allow local attacker to access files of One UI. |
CVE-2022-31662 | High | 7.5 | 2022-08-05 | VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access… |
CVE-2022-2531 | Medium | 5.3 | 2022-08-05 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions… |
CVE-2021-27798 | Medium | 5.5 | 2022-08-05 | A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions… |
CVE-2022-31793 | High | 7.5 | 2022-08-04 | do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired… |
CVE-2022-31473 | Medium | 6.8 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mod… |
CVE-2022-35216 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authen… |
CVE-2022-32963 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authent… |
CVE-2022-2653 | Medium | 6.5 | 2022-08-04 | With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment varia… |
CVE-2022-27621 | Medium | 5.5 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows… |
CVE-2022-27620 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allow… |
CVE-2022-27618 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390… |
CVE-2022-27617 | Medium | 5.0 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows… |
CVE-2022-30572 | Medium | 6.5 | 2022-08-02 | The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability… |
CVE-2022-35920 | High | 8.3 | 2022-08-01 | Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2… |
CVE-2022-35919 | High | 7.4 | 2022-08-01 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin… |
CVE-2022-35918 | Medium | 6.5 | 2022-08-01 | Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a direct… |
CVE-2022-31195 | High | 7.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is v… |
CVE-2022-31194 | High | 8.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-2184 | High | 8.8 | 2022-08-01 | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by att… |
CVE-2021-22650 | High | 7.5 | 2022-07-28 | An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code executio… |
CVE-2022-27611 | Medium | 5.4 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 al… |
CVE-2022-22685 | High | 8.7 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 al… |
CVE-2022-27615 | High | 7.7 | 2022-07-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows r… |
CVE-2021-46830 | Medium | 6.5 | 2022-07-27 | A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could… |
CVE-2022-36890 | Medium | 4.3 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers… |
CVE-2022-36889 | High | 8.8 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowi… |
CVE-2022-34551 | Medium | 6.5 | 2022-07-27 | Sims v1.0 was discovered to allow path traversal when downloading attachments. |
CVE-2022-27610 | Medium | 6.5 | 2022-07-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-24992 | High | 7.5 | 2022-07-25 | A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal. |
CVE-2022-35650 | High | 7.5 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary… |
CVE-2020-7649 | Medium | 4.9 | 2022-07-25 | This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal. |
CVE-2017-20145 | Medium | 6.3 | 2022-07-25 | A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be… |
CVE-2022-1128 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross… |