CWE-22 · Path Traversal (page 57)
Page 57 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23119 | High | 7.5 | 2022-01-20 | A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker… |
CVE-2021-44737 | High | 8.8 | 2022-01-20 | PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. |
CVE-2021-46203 | Medium | 6.5 | 2022-01-19 | Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. |
CVE-2021-46104 | High | 7.5 | 2022-01-19 | An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server. |
CVE-2022-21371 | High | 7.5 | 2022-01-19 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0… |
CVE-2022-21693 | Medium | 6.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-22054 | Medium | 6.5 | 2022-01-14 | ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows a… |
CVE-2022-21682 | High | 7.7 | 2022-01-13 | Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. fl… |
CVE-2021-23514 | Medium | 6.5 | 2022-01-13 | This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server. |
CVE-2022-23113 | Medium | 4.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal… |
CVE-2022-23107 | High | 8.1 | 2022-01-12 | Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Config… |
CVE-2022-21675 | Critical | 9.9 | 2022-01-12 | Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive E… |
CVE-2021-28377 | Medium | 5.3 | 2022-01-12 | ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files. |
CVE-2021-28376 | Low | 2.7 | 2022-01-12 | ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files. |
CVE-2021-37196 | Medium | 6.5 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-44586 | High | 7.5 | 2022-01-10 | An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information. |
CVE-2022-22836 | Medium | 6.5 | 2022-01-10 | CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request. |
CVE-2022-22821 | Low | 2.0 | 2022-01-10 | NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are av… |
CVE-2021-40003 | Medium | 5.3 | 2022-01-10 | HwPCAssistant has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-40001 | Medium | 5.3 | 2022-01-10 | The CaasKit module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the MeeTime application to be unavailable. |
CVE-2020-29050 | High | 7.5 | 2022-01-10 | SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used f… |
CVE-2021-44351 | High | 7.5 | 2022-01-06 | An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter. |
CVE-2021-45452 | Medium | 5.3 | 2022-01-05 | Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. |
CVE-2021-39143 | Medium | 6.6 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for depl… |
CVE-2021-40525 | Critical | 9.1 | 2022-01-04 | Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any fi… |
CVE-2021-39970 | High | 7.5 | 2022-01-03 | HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission. |
CVE-2021-37128 | Critical | 9.8 | 2022-01-03 | HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file. |
CVE-2021-37126 | High | 7.5 | 2022-01-03 | Arbitrary file has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability .Successful exploitation of this vulnerability may cause the dire… |
CVE-2021-44674 | Medium | 6.5 | 2022-01-03 | An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the… |
CVE-2021-25021 | Medium | 4.9 | 2022-01-03 | The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path… |
CVE-2021-25020 | Medium | 4.9 | 2022-01-03 | The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a pa… |
CVE-2021-20134 | High | 8.4 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authent… |
CVE-2021-20133 | Medium | 6.1 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authent… |
CVE-2021-45427 | Critical | 9.8 | 2021-12-30 | Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files with… |
CVE-2020-20944 | Critical | 9.1 | 2021-12-27 | An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files. |
CVE-2021-45712 | High | 7.5 | 2021-12-26 | An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode. |
CVE-2021-20876 | Medium | 6.8 | 2021-12-24 | Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and e… |
CVE-2021-44548 | Critical | 9.8 | 2021-12-23 | An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network cal… |
CVE-2021-21909 | High | 8.1 | 2021-12-22 | Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command. An attacker can provide malicious inputs… |
CVE-2021-21908 | Medium | 6.5 | 2021-12-22 | Specially-crafted command line arguments can lead to arbitrary file deletion. The handle_delete function does not attempt to sanitize or otherwise validate the… |
CVE-2021-21907 | Medium | 4.9 | 2021-12-22 | A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-craft… |
CVE-2021-21904 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0. An attacker can provide malicio… |
CVE-2021-21896 | Medium | 6.5 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafte… |
CVE-2021-21895 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21894 | Critical | 9.1 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21886 | Medium | 4.3 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP requ… |
CVE-2021-21885 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP request ca… |
CVE-2021-21880 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reques… |
CVE-2021-21879 | High | 8.8 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-45418 | High | 8.8 | 2021-12-22 | Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9… |
CVE-2021-44162 | High | 7.5 | 2021-12-20 | Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in UR… |
CVE-2021-23797 | High | 7.5 | 2021-12-17 | All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is. |
CVE-2021-43840 | Medium | 4.4 | 2021-12-17 | message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled… |
CVE-2021-32498 | High | 8.6 | 2021-12-17 | SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on… |
CVE-2021-3960 | High | 7.1 | 2021-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an… |
CVE-2021-43836 | High | 8.5 | 2021-12-15 | Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP… |
CVE-2021-43831 | High | 7.7 | 2021-12-15 | Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects… |
CVE-2021-45043 | High | 7.5 | 2021-12-15 | HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. |
CVE-2021-44232 | High | 7.7 | 2021-12-14 | SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server d… |
CVE-2021-39312 | High | 7.5 | 2021-12-14 | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src… |
CVE-2021-45015 | Critical | 9.1 | 2021-12-14 | taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72. |
CVE-2021-42022 | Medium | 6.5 | 2021-12-14 | A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not prope… |
CVE-2021-41547 | High | 7.2 | 2021-12-14 | A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Te… |
CVE-2021-44965 | High | 7.5 | 2021-12-13 | Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download se… |
CVE-2021-24970 | High | 7.2 | 2021-12-13 | The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin… |
CVE-2021-40858 | Medium | 4.9 | 2021-12-13 | Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passw… |
CVE-2021-41242 | High | 8.1 | 2021-12-10 | OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filen… |
CVE-2021-43815 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv fi… |
CVE-2021-43813 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability fo… |
CVE-2021-31746 | Critical | 9.8 | 2021-12-10 | Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arb… |
CVE-2021-41449 | High | 7.1 | 2021-12-09 | A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access… |
CVE-2021-25511 | Medium | 6.3 | 2021-12-08 | An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerabi… |
CVE-2021-41024 | High | 7.5 | 2021-12-08 | A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized at… |
CVE-2021-20040 | High | 7.5 | 2021-12-08 | A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody… |
CVE-2021-44725 | High | 7.5 | 2021-12-08 | KNIME Server before 4.13.4 allows directory traversal in a request for a client profile. |
CVE-2021-43798 | High | 7.5 | 2021-12-07 | Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to… |
CVE-2021-43176 | High | 8.8 | 2021-12-07 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and… |
CVE-2021-37099 | Critical | 9.1 | 2021-12-07 | There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete any file. |
CVE-2021-37088 | Critical | 9.1 | 2021-12-07 | There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write any content to any f… |
CVE-2021-37087 | Critical | 9.1 | 2021-12-07 | There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can create arbitrary file. |
CVE-2021-37064 | Critical | 9.1 | 2021-12-07 | There is a Improper Limitation of a Pathname to a Restricted Directory vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lea… |
CVE-2021-43800 | High | 7.5 | 2021-12-06 | Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local a… |
CVE-2021-43676 | Critical | 9.8 | 2021-12-03 | matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. |
CVE-2021-44278 | Critical | 9.8 | 2021-12-03 | Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. |
CVE-2021-43674 | Critical | 9.8 | 2021-12-03 | ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer sup… |
CVE-2021-43795 | High | 7.5 | 2021-12-02 | Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted direc… |
CVE-2021-43358 | High | 7.5 | 2021-12-01 | Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, a… |
CVE-2021-43788 | Medium | 5.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files out… |
CVE-2021-43783 | High | 8.5 | 2021-11-29 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a… |
CVE-2021-43691 | Critical | 9.8 | 2021-11-29 | tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"]… |
CVE-2021-32061 | Medium | 5.3 | 2021-11-29 | S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element. |
CVE-2021-41279 | High | 7.7 | 2021-11-26 | BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload cra… |
CVE-2021-43778 | Critical | 9.1 | 2021-11-24 | Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable… |
CVE-2021-43775 | High | 8.6 | 2021-11-23 | Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By mani… |
CVE-2021-41281 | High | 7.5 | 2021-11-23 | Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tr… |
CVE-2021-24644 | High | 7.5 | 2021-11-23 | The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to… |
CVE-2021-37023 | Medium | 6.5 | 2021-11-23 | There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads a… |
CVE-2020-7882 | High | 7.5 | 2021-11-22 | Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the… |
CVE-2021-38146 | High | 7.5 | 2021-11-22 | The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in th… |
CVE-2021-33491 | Medium | 6.5 | 2021-11-22 | OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths in mail addresses i… |