CWE-22 · Path Traversal (page 58)
Page 58 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43555 | High | 7.3 | 2021-11-19 | mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path t… |
CVE-2021-22028 | Critical | 9.1 | 2021-11-19 | In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure… |
CVE-2021-37938 | Medium | 4.3 | 2021-11-18 | It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this… |
CVE-2021-41277 | Critical | 10.0 | 2021-11-17 | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->ma… |
CVE-2021-40745 | High | 7.5 | 2021-11-17 | Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an e… |
CVE-2021-41950 | Critical | 9.1 | 2021-11-15 | A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace se… |
CVE-2021-43495 | High | 7.5 | 2021-11-15 | AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This att… |
CVE-2021-43493 | High | 7.5 | 2021-11-12 | ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. This vulnerability can… |
CVE-2021-43492 | High | 7.5 | 2021-11-12 | AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the discl… |
CVE-2021-43496 | High | 7.5 | 2021-11-12 | Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the di… |
CVE-2021-43494 | High | 7.5 | 2021-11-12 | OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability. This attack can cause t… |
CVE-2021-34422 | High | 7.2 | 2021-11-11 | The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malic… |
CVE-2021-3907 | High | 7.4 | 2021-11-11 | OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/e… |
CVE-2021-22870 | Medium | 6.5 | 2021-11-10 | A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit… |
CVE-2021-42021 | High | 7.5 | 2021-11-09 | A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3… |
CVE-2021-40359 | High | 7.7 | 2021-11-09 | A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V… |
CVE-2021-40358 | Critical | 9.9 | 2021-11-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2021-3924 | High | 7.5 | 2021-11-05 | grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-3916 | Medium | 6.5 | 2021-11-05 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-21698 | High | 7.5 | 2021-11-04 | Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. |
CVE-2021-21692 | Critical | 9.8 | 2021-11-04 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission… |
CVE-2021-21690 | Critical | 9.8 | 2021-11-04 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303… |
CVE-2021-34701 | Medium | 4.3 | 2021-11-04 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2021-34594 | Medium | 6.5 | 2021-11-04 | TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path trav… |
CVE-2021-33800 | High | 7.5 | 2021-11-03 | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. |
CVE-2021-43264 | Low | 3.3 | 2021-11-02 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access con… |
CVE-2020-18438 | High | 7.5 | 2021-11-02 | Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php. |
CVE-2021-29212 | Critical | 9.8 | 2021-11-01 | A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulne… |
CVE-2020-25881 | Medium | 5.5 | 2021-10-29 | A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename=../../../../111.txt&filetype=image/jpeg… |
CVE-2020-25873 | Medium | 6.5 | 2021-10-29 | A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attackers to arbitrarily… |
CVE-2020-25872 | Medium | 4.9 | 2021-10-29 | A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traversal attack via a GE… |
CVE-2021-3823 | High | 7.1 | 2021-10-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an… |
CVE-2021-22404 | Medium | 5.3 | 2021-10-28 | There is a Directory traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-34762 | High | 8.1 | 2021-10-27 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perf… |
CVE-2021-37130 | High | 7.5 | 2021-10-27 | There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname th… |
CVE-2021-37124 | Medium | 6.5 | 2021-10-27 | There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file p… |
CVE-2019-3556 | High | 8.1 | 2021-10-26 | HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to outp… |
CVE-2021-41185 | High | 8.8 | 2021-10-26 | Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files ou… |
CVE-2021-41178 | High | 8.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker… |
CVE-2021-34860 | Medium | 6.5 | 2021-10-25 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authenti… |
CVE-2021-40371 | Critical | 9.8 | 2021-10-25 | Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\ in a scriptName… |
CVE-2020-36488 | Medium | 6.5 | 2021-10-22 | An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands. |
CVE-2020-23061 | High | 7.5 | 2021-10-22 | Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and `download` module which allows attacke… |
CVE-2020-23040 | High | 7.5 | 2021-10-22 | Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via 'null' path comman… |
CVE-2020-23038 | High | 7.5 | 2021-10-22 | Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is expl… |
CVE-2021-42556 | Medium | 5.5 | 2021-10-22 | Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker… |
CVE-2021-42542 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure. |
CVE-2021-35230 | Medium | 6.7 | 2021-10-22 | As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by ins… |
CVE-2021-41127 | High | 7.3 | 2021-10-21 | Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functional… |
CVE-2020-27304 | Critical | 9.8 | 2021-10-21 | The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mec… |
CVE-2021-42771 | High | 7.8 | 2021-10-20 | Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading… |
CVE-2021-41150 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-31385 | High | 8.8 | 2021-10-19 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged… |
CVE-2021-41149 | High | 8.2 | 2021-10-19 | Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not… |
CVE-2021-41131 | High | 7.5 | 2021-10-19 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vul… |
CVE-2021-42261 | High | 7.5 | 2021-10-19 | Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the fil… |
CVE-2021-41152 | High | 7.7 | 2021-10-18 | OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by… |
CVE-2021-41151 | Medium | 6.8 | 2021-10-18 | Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaf… |
CVE-2021-40724 | High | 7.8 | 2021-10-15 | Acrobat Reader for Android versions 21.8.0 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulner… |
CVE-2021-40988 | High | 7.2 | 2021-10-15 | A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - Cle… |
CVE-2021-3874 | Medium | 6.5 | 2021-10-15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2021-38346 | High | 8.8 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_crea… |
CVE-2021-33178 | Medium | 6.5 | 2021-10-14 | The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of thi… |
CVE-2021-20125 | Critical | 9.8 | 2021-10-13 | An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3… |
CVE-2021-20124 | High | 7.5 | 2021-10-13 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated… |
CVE-2021-20123 | High | 7.5 | 2021-10-13 | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthe… |
CVE-2021-20796 | Medium | 6.5 | 2021-10-13 | Directory traversal vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to upload an arbitrary file vi… |
CVE-2021-37734 | Medium | 6.5 | 2021-10-12 | A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x… |
CVE-2021-38460 | High | 7.5 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-38454 | Critical | 10.0 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-38452 | High | 7.5 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-33726 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user contro… |
CVE-2021-33725 | Critical | 9.1 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under… |
CVE-2021-33724 | Critical | 9.1 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that… |
CVE-2021-33722 | Medium | 4.9 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a fi… |
CVE-2021-29006 | Medium | 6.5 | 2021-10-11 | rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. |
CVE-2021-40887 | Critical | 9.8 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add… |
CVE-2021-40886 | Medium | 6.5 | 2021-10-11 | Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fil… |
CVE-2021-42013 | Critical | 9.8 | 2021-10-07 | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files… |
CVE-2021-37922 | Medium | 5.3 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another. |
CVE-2021-40978 | High | 7.5 | 2021-10-07 | The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the v… |
CVE-2021-21683 | Medium | 6.5 | 2021-10-06 | The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal… |
CVE-2021-34711 | Medium | 5.5 | 2021-10-06 | A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vul… |
CVE-2021-25485 | High | 7.5 | 2021-10-06 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket. |
CVE-2020-15941 | Medium | 5.4 | 2021-10-06 | A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory tra… |
CVE-2021-41773 | Critical | 9.8 | 2021-10-05 | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outsid… |
CVE-2021-41579 | High | 7.8 | 2021-10-04 | LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a victim to load a malicious els project file… |
CVE-2021-41578 | High | 7.8 | 2021-10-04 | mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicio… |
CVE-2021-41596 | Medium | 5.3 | 2021-10-04 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile… |
CVE-2021-41595 | Medium | 5.3 | 2021-10-04 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name… |
CVE-2021-41103 | High | 7.8 | 2021-10-04 | containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root d… |
CVE-2021-21706 | Medium | 5.3 | 2021-10-04 | In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writ… |
CVE-2021-40960 | Critical | 9.8 | 2021-10-01 | Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. |
CVE-2021-3710 | Medium | 6.5 | 2021-10-01 | An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2… |
CVE-2021-3709 | Medium | 6.5 | 2021-10-01 | Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issu… |
CVE-2021-41324 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files b… |
CVE-2021-41323 | Medium | 6.5 | 2021-09-30 | Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any… |
CVE-2021-41294 | Critical | 9.1 | 2021-09-30 | ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers… |
CVE-2021-41293 | High | 7.5 | 2021-09-30 | ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attacke… |
CVE-2021-41291 | High | 7.5 | 2021-09-30 | ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remo… |