CWE-22 · Path Traversal (page 56)
Page 56 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23347 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. |
CVE-2022-26960 | Critical | 9.1 | 2022-03-21 | connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse f… |
CVE-2020-25176 | Critical | 9.1 | 2022-03-18 | Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sy… |
CVE-2021-45967 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal i… |
CVE-2022-26500 | High | 8.8 | 2022-03-17 | Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions… |
CVE-2022-21221 | Medium | 5.9 | 2022-03-17 | The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is pos… |
CVE-2022-1000 | Critical | 9.8 | 2022-03-17 | Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. |
CVE-2022-25249 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) i… |
CVE-2022-0959 | Medium | 6.5 | 2022-03-16 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to… |
CVE-2021-29134 | Medium | 5.3 | 2022-03-15 | The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL. |
CVE-2022-27208 | Medium | 6.5 | 2022-03-15 | Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. |
CVE-2022-27203 | Medium | 6.5 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and… |
CVE-2022-22771 | High | 8.8 | 2022-03-15 | The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO… |
CVE-2021-45010 | High | 8.8 | 2022-03-15 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid us… |
CVE-2021-24692 | Medium | 6.5 | 2022-03-14 | The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-con… |
CVE-2021-45887 | Critical | 9.8 | 2022-03-13 | An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for uploaded ZIP files, an executable script… |
CVE-2022-26276 | Medium | 5.3 | 2022-03-12 | An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. |
CVE-2022-25216 | High | 7.5 | 2022-03-11 | An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12… |
CVE-2022-21808 | High | 8.8 | 2022-03-11 | Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.0… |
CVE-2022-21177 | High | 8.1 | 2022-03-11 | There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10… |
CVE-2022-26652 | Medium | 6.5 | 2022-03-10 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server befor… |
CVE-2022-21132 | Medium | 6.5 | 2022-03-10 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior… |
CVE-2021-42857 | Medium | 5.3 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInte… |
CVE-2021-42854 | Critical | 9.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInter… |
CVE-2021-42853 | Critical | 9.1 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/a… |
CVE-2021-42787 | Critical | 9.4 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/… |
CVE-2022-24716 | High | 7.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the loca… |
CVE-2022-24715 | High | 8.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can creat… |
CVE-2021-32008 | Critical | 9.9 | 2022-03-04 | This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged… |
CVE-2022-26484 | Medium | 4.9 | 2022-03-04 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize… |
CVE-2021-46381 | High | 7.5 | 2022-03-04 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. |
CVE-2021-3762 | Critical | 9.8 | 2022-03-03 | A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when… |
CVE-2021-41002 | High | 8.1 | 2022-03-02 | Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 S… |
CVE-2021-43070 | Medium | 5.4 | 2022-03-02 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below… |
CVE-2022-25634 | High | 7.5 | 2022-03-02 | Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. |
CVE-2022-24718 | High | 7.6 | 2022-03-01 | ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing u… |
CVE-2021-42767 | Critical | 9.1 | 2022-03-01 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local… |
CVE-2022-25412 | High | 8.1 | 2022-02-28 | Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile… |
CVE-2022-26315 | Medium | 5.3 | 2022-02-28 | qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader. |
CVE-2021-24820 | Medium | 6.5 | 2022-02-28 | The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path tra… |
CVE-2021-24689 | Medium | 4.9 | 2022-02-28 | The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server… |
CVE-2021-44665 | Medium | 6.5 | 2022-02-24 | A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php. |
CVE-2021-44664 | High | 8.8 | 2022-02-24 | An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously craf… |
CVE-2022-23135 | Medium | 6.5 | 2022-02-24 | There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attack… |
CVE-2022-22349 | Medium | 4.3 | 2022-02-24 | IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuratio… |
CVE-2021-45746 | High | 7.5 | 2022-02-24 | A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java. |
CVE-2020-27467 | High | 7.5 | 2022-02-24 | A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php. |
CVE-2022-23612 | High | 7.5 | 2022-02-22 | OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subje… |
CVE-2022-0665 | Medium | 6.5 | 2022-02-22 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. |
CVE-2021-27755 | Medium | 5.5 | 2022-02-21 | "Sametime Android potential path traversal vulnerability when using File class" |
CVE-2021-27753 | Medium | 5.5 | 2022-02-21 | "Sametime Android PathTraversal Vulnerability" |
CVE-2021-25082 | High | 8.8 | 2022-02-21 | The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Loc… |
CVE-2022-25358 | Medium | 5.3 | 2022-02-18 | A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). Thi… |
CVE-2021-40841 | Medium | 6.5 | 2022-02-18 | A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server. |
CVE-2022-0673 | Medium | 6.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal. |
CVE-2021-26619 | High | 7.1 | 2022-02-18 | An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitra… |
CVE-2022-25298 | High | 7.5 | 2022-02-18 | This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server. |
CVE-2022-22914 | High | 7.5 | 2022-02-17 | An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the uploa… |
CVE-2022-24983 | High | 7.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained… |
CVE-2021-35380 | High | 7.5 | 2022-02-15 | A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to… |
CVE-2022-25188 | Medium | 4.3 | 2022-02-15 | Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configur… |
CVE-2022-25178 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, all… |
CVE-2021-43734 | High | 7.5 | 2022-02-15 | kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. |
CVE-2022-24977 | Critical | 9.8 | 2022-02-14 | ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction w… |
CVE-2021-44111 | Medium | 4.4 | 2022-02-11 | A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup. |
CVE-2021-22804 | High | 7.5 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the con… |
CVE-2021-22748 | High | 8.8 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a f… |
CVE-2020-14523 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code. |
CVE-2022-24647 | High | 8.1 | 2022-02-10 | Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function. |
CVE-2022-24312 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end o… |
CVE-2022-24311 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at be… |
CVE-2022-23620 | Medium | 6.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionH… |
CVE-2021-45286 | Medium | 5.3 | 2022-02-09 | Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php. |
CVE-2022-21999 | High | 7.8 | 2022-02-09 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-21193 | High | 7.5 | 2022-02-08 | Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspeci… |
CVE-2022-22931 | Medium | 4.3 | 2022-02-07 | Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file reposi… |
CVE-2022-22679 | Medium | 6.5 | 2022-02-07 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM… |
CVE-2022-23609 | High | 8.3 | 2022-02-04 | iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input u… |
CVE-2022-24348 | High | 7.7 | 2022-02-04 | Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example… |
CVE-2021-29398 | Medium | 5.3 | 2022-02-04 | Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthe… |
CVE-2021-29395 | High | 7.5 | 2022-02-04 | Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to do… |
CVE-2021-44977 | High | 7.5 | 2022-02-04 | In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. |
CVE-2022-23357 | Critical | 9.1 | 2022-02-03 | mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir. |
CVE-2021-42753 | High | 8.1 | 2022-02-02 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3… |
CVE-2022-0401 | Critical | 9.8 | 2022-02-01 | Path Traversal in NPM w-zip prior to 1.0.12. |
CVE-2022-0320 | Critical | 9.8 | 2022-02-01 | The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which… |
CVE-2021-24761 | Medium | 6.5 | 2022-02-01 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which cou… |
CVE-2022-23602 | High | 7.7 | 2022-02-01 | Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include refer… |
CVE-2021-23520 | Medium | 5.5 | 2022-01-31 | The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function… |
CVE-2022-23409 | Medium | 4.9 | 2022-01-31 | The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php. |
CVE-2021-34805 | High | 7.5 | 2022-01-31 | An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without pr… |
CVE-2021-23484 | Critical | 9.8 | 2022-01-28 | The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file o… |
CVE-2022-22790 | Medium | 5.6 | 2022-01-28 | SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system… |
CVE-2021-32841 | Medium | 4.0 | 2022-01-26 | SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is… |
CVE-2021-32842 | Medium | 4.0 | 2022-01-26 | SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is… |
CVE-2021-32840 | High | 7.3 | 2022-01-26 | SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory… |
CVE-2022-22932 | Medium | 5.3 | 2022-01-26 | Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as… |
CVE-2020-17383 | Critical | 9.8 | 2022-01-24 | A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system… |
CVE-2021-23631 | High | 7.5 | 2022-01-21 | This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a special… |
CVE-2020-19858 | High | 7.5 | 2022-01-21 | Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to… |