CWE-22 · Path Traversal (page 64)
Page 64 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25068 | High | 7.5 | 2020-09-03 | Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal f… |
CVE-2020-6142 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclu… |
CVE-2012-3337 | Medium | 5.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2020-7669 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in… |
CVE-2020-7666 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink ba… |
CVE-2020-7665 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip… |
CVE-2020-7522 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-7521 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-25032 | High | 7.5 | 2020-08-31 | An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resou… |
CVE-2020-14352 | High | 8.0 | 2020-08-30 | A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository met… |
CVE-2020-12456 | High | 8.8 | 2020-08-26 | A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notif… |
CVE-2020-3490 | Medium | 4.9 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrativ… |
CVE-2020-3440 | Medium | 6.5 | 2020-08-26 | A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user sys… |
CVE-2020-17389 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-17387 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15644 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15643 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15641 | High | 7.5 | 2020-08-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is… |
CVE-2020-15640 | High | 7.5 | 2020-08-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is… |
CVE-2020-15639 | Critical | 9.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not requ… |
CVE-2020-16245 | Critical | 9.8 | 2020-08-25 | Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download a… |
CVE-2020-17385 | High | 7.5 | 2020-08-25 | Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access ar… |
CVE-2020-7377 | High | 8.1 | 2020-08-24 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar meth… |
CVE-2020-7376 | High | 7.1 | 2020-08-24 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can… |
CVE-2020-19877 | Medium | 5.3 | 2020-08-24 | DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can ex… |
CVE-2020-8227 | Medium | 6.8 | 2020-08-21 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedica… |
CVE-2020-15858 | Medium | 6.2 | 2020-08-21 | Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check… |
CVE-2020-24571 | High | 7.5 | 2020-08-21 | NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. |
CVE-2020-24368 | High | 7.5 | 2020-08-19 | Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are rea… |
CVE-2020-8209 | High | 7.5 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-9708 | Medium | 5.9 | 2020-08-14 | The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. Thi… |
CVE-2020-15141 | Low | 3.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI docume… |
CVE-2019-4582 | Medium | 4.3 | 2020-08-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2020-8913 | High | 8.8 | 2020-08-12 | A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious… |
CVE-2020-13376 | Critical | 9.0 | 2020-08-07 | SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie. |
CVE-2020-5609 | Critical | 9.8 | 2020-08-05 | Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Bas… |
CVE-2020-16116 | Low | 3.3 | 2020-08-03 | In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. |
CVE-2020-16136 | High | 7.7 | 2020-07-31 | In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owne… |
CVE-2020-3383 | High | 8.8 | 2020-07-31 | A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal… |
CVE-2020-8222 | Medium | 6.8 | 2020-07-30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an a… |
CVE-2020-8221 | Medium | 4.9 | 2020-07-30 | A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web i… |
CVE-2020-9689 | Medium | 6.5 | 2020-07-29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execu… |
CVE-2020-14490 | High | 8.8 | 2020-07-29 | OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensiti… |
CVE-2020-5614 | Medium | 5.3 | 2020-07-29 | Directory traversal vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2020-5377 | Critical | 9.1 | 2020-07-28 | Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker coul… |
CVE-2020-15712 | Medium | 4.3 | 2020-07-28 | rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByP… |
CVE-2020-15592 | High | 7.5 | 2020-07-27 | SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a high privileged Win… |
CVE-2020-7687 | High | 7.5 | 2020-07-25 | This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js. |
CVE-2020-7686 | High | 7.5 | 2020-07-25 | This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function. |
CVE-2020-7683 | High | 7.5 | 2020-07-25 | This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase fun… |
CVE-2020-7682 | High | 7.5 | 2020-07-25 | This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js. |
CVE-2020-7681 | High | 7.5 | 2020-07-25 | This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js. |
CVE-2020-15923 | High | 7.5 | 2020-07-24 | Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. |
CVE-2020-15492 | Critical | 9.8 | 2020-07-23 | An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) i… |
CVE-2020-15908 | High | 7.5 | 2020-07-23 | tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. |
CVE-2020-9663 | Medium | 5.3 | 2020-07-22 | Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-3452 | High | 7.5 | 2020-07-22 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-15124 | Critical | 9.6 | 2020-07-22 | In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This i… |
CVE-2016-7063 | Critical | 9.8 | 2020-07-21 | A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation. |
CVE-2020-12499 | High | 8.2 | 2020-07-21 | In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files. |
CVE-2020-8214 | High | 7.5 | 2020-07-20 | A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file. |
CVE-2020-9252 | Low | 2.3 | 2020-07-17 | HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlie… |
CVE-2020-7684 | High | 7.5 | 2020-07-17 | This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation. |
CVE-2020-3401 | Medium | 6.5 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal… |
CVE-2020-3381 | High | 8.8 | 2020-07-16 | A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct directory traversal a… |
CVE-2020-15779 | High | 7.5 | 2020-07-15 | A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../… |
CVE-2020-11439 | High | 8.8 | 2020-07-15 | LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application. |
CVE-2020-14507 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary fil… |
CVE-2020-6286 | Medium | 5.3 | 2020-07-14 | The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40… |
CVE-2020-15050 | High | 7.5 | 2020-07-13 | An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Trave… |
CVE-2020-8195 | Medium | 6.5 | 2020-07-10 | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O… |
CVE-2020-5366 | High | 7.1 | 2020-07-09 | Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentiall… |
CVE-2020-5764 | High | 8.8 | 2020-07-08 | MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive"… |
CVE-2020-15583 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. StickerProvider allows directory traversal for access to system fi… |
CVE-2020-8161 | High | 8.6 | 2020-07-02 | A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is… |
CVE-2020-5902 | Critical | 9.8 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also… |
CVE-2020-13383 | High | 7.5 | 2020-07-01 | openSIS through 7.4 allows Directory Traversal. |
CVE-2020-5588 | Medium | 4.9 | 2020-06-30 | Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via unspecified vectors. |
CVE-2020-5581 | Medium | 6.5 | 2020-06-30 | Path traversal vulnerability in Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to obtain unintended information via unspecified vectors. |
CVE-2020-15026 | Medium | 4.9 | 2020-06-24 | Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php. |
CVE-2020-7667 | High | 7.5 | 2020-06-24 | In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for… |
CVE-2020-7668 | High | 7.5 | 2020-06-23 | In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or no… |
CVE-2020-7664 | High | 7.5 | 2020-06-23 | In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or n… |
CVE-2020-14946 | Medium | 4.3 | 2020-06-22 | downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transac… |
CVE-2020-13158 | High | 7.5 | 2020-06-22 | Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter. |
CVE-2020-14461 | High | 8.6 | 2020-06-22 | Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI. |
CVE-2017-18912 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file. |
CVE-2017-18874 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversa… |
CVE-2019-20851 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary… |
CVE-2020-14452 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014. |
CVE-2020-5590 | High | 8.1 | 2020-06-19 | Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or director… |
CVE-2020-3241 | Medium | 6.5 | 2020-06-18 | A vulnerability in the orchestration tasks of Cisco UCS Director could allow an authenticated, remote attacker to perform a path traversal attack on an affecte… |
CVE-2020-3236 | Medium | 6.7 | 2020-06-18 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to th… |
CVE-2020-12827 | High | 7.2 | 2020-06-17 | MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document. |
CVE-2020-4053 | Low | 3.7 | 2020-06-16 | In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It i… |
CVE-2020-7497 | Critical | 9.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-7495 | Medium | 5.5 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operato… |
CVE-2020-7494 | High | 7.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-12003 | High | 7.5 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-0539 | Medium | 5.5 | 2020-06-15 | Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE… |