CWE-22 · Path Traversal (page 66)
Page 66 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5284 | Medium | 4.4 | 2020-03-30 | Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). T… |
CVE-2020-10953 | High | 7.5 | 2020-03-27 | In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. |
CVE-2015-8535 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disc… |
CVE-2020-5280 | High | 7.6 | 2020-03-25 | http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.stat… |
CVE-2020-5554 | Critical | 9.1 | 2020-03-25 | Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified ve… |
CVE-2020-10875 | High | 7.5 | 2020-03-23 | Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewta… |
CVE-2020-8865 | Medium | 6.3 | 2020-03-23 | This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is re… |
CVE-2020-7478 | High | 7.5 | 2020-03-23 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2019-19486 | Medium | 6.5 | 2020-03-20 | Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test. |
CVE-2019-16064 | Critical | 9.6 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored… |
CVE-2020-9325 | High | 7.5 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download. |
CVE-2020-9323 | Medium | 5.3 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx. |
CVE-2020-8600 | Critical | 9.8 | 2020-03-18 | Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key f… |
CVE-2018-18576 | Medium | 5.3 | 2020-03-17 | The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI. |
CVE-2020-1735 | Medium | 4.2 | 2020-03-16 | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destinat… |
CVE-2020-10564 | Critical | 9.8 | 2020-03-13 | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted t… |
CVE-2019-13195 | High | 7.5 | 2020-03-13 | The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user… |
CVE-2020-10086 | Medium | 5.3 | 2020-03-13 | GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file r… |
CVE-2019-12182 | Critical | 9.8 | 2020-03-13 | Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API. |
CVE-2020-0520 | High | 7.8 | 2020-03-12 | Path traversal in igdkmd64.sys for Intel(R) Graphics Drivers before versions 15.45.30.5103, 15.40.44.5107, 15.36.38.5117 and 15.33.49.5100 may allow an authent… |
CVE-2020-10459 | Low | 2.7 | 2020-03-12 | Path Traversal in admin/assetmanager/assetmanager.php (vulnerable function saved in admin/assetmanager/functions.php) in Chadha PHPKB Standard Multi-Language 9… |
CVE-2020-10458 | Medium | 6.5 | 2020-03-12 | Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot… |
CVE-2020-10457 | Low | 2.7 | 2020-03-12 | Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a d… |
CVE-2020-10387 | Medium | 4.9 | 2020-03-12 | Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash… |
CVE-2020-6203 | Critical | 9.1 | 2020-03-10 | SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat… |
CVE-2019-19297 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video… |
CVE-2019-19296 | Medium | 6.8 | 2020-03-10 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The two FTP services (default ports 21/tcp and 5411/tcp) of the SiVMS/… |
CVE-2019-19290 | Medium | 6.5 | 2020-03-10 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The DOWNLOADS section in the web interface of the Control Center Se… |
CVE-2018-18894 | High | 7.5 | 2020-03-10 | Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server. |
CVE-2020-2139 | Medium | 6.5 | 2020-03-09 | An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwr… |
CVE-2020-1737 | High | 7.5 | 2020-03-09 | A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extract… |
CVE-2020-5405 | Medium | 6.5 | 2020-03-05 | Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configu… |
CVE-2020-9364 | Medium | 5.3 | 2020-03-04 | An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability r… |
CVE-2019-3696 | High | 8.4 | 2020-03-03 | A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPO… |
CVE-2019-7007 | High | 7.5 | 2020-02-28 | A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potential… |
CVE-2020-8810 | High | 8.1 | 2020-02-25 | An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OB… |
CVE-2020-8131 | High | 7.5 | 2020-02-24 | Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code e… |
CVE-2020-5187 | High | 8.8 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). |
CVE-2020-9354 | High | 7.5 | 2020-02-23 | An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOpera… |
CVE-2020-9353 | High | 7.5 | 2020-02-23 | An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOpera… |
CVE-2014-4650 | Critical | 9.8 | 2020-02-20 | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attacke… |
CVE-2014-7951 | Medium | 4.6 | 2020-02-20 | Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the… |
CVE-2014-9609 | Medium | 5.3 | 2020-02-19 | Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remot… |
CVE-2020-1853 | Medium | 6.5 | 2020-02-17 | GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse direct… |
CVE-2020-9033 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authl… |
CVE-2020-9032 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernl… |
CVE-2020-9031 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemo… |
CVE-2020-9030 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the s… |
CVE-2020-9029 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messa… |
CVE-2020-8996 | Medium | 4.3 | 2020-02-16 | AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/pass… |
CVE-2015-6589 | High | 8.8 | 2020-02-13 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and… |
CVE-2015-3309 | High | 7.5 | 2020-02-13 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of t… |
CVE-2020-8803 | Critical | 9.8 | 2020-02-13 | SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. |
CVE-2020-6768 | High | 8.6 | 2020-02-07 | A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files… |
CVE-2020-6767 | High | 7.7 | 2020-02-06 | A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files… |
CVE-2020-5720 | Medium | 5.9 | 2020-02-06 | MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. Win… |
CVE-2020-8641 | High | 8.8 | 2020-02-05 | Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter. |
CVE-2020-6754 | Critical | 9.8 | 2020-02-05 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOM… |
CVE-2020-7966 | High | 7.5 | 2020-02-05 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. |
CVE-2020-5237 | High | 8.8 | 2020-02-05 | Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files o… |
CVE-2019-4674 | Medium | 4.9 | 2020-02-04 | IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2020-8545 | High | 7.5 | 2020-02-03 | Global.py in AIL framework 2.8 allows path traversal. |
CVE-2014-5236 | High | 7.5 | 2020-01-31 | Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remot… |
CVE-2020-8446 | Medium | 5.5 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via cr… |
CVE-2020-3717 | Medium | 5.3 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitat… |
CVE-2015-7851 | Medium | 6.5 | 2020-01-28 | Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' c… |
CVE-2013-4861 | Medium | 6.5 | 2020-01-28 | Directory traversal vulnerability in cgi-bin/cmh/get_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary f… |
CVE-2012-6609 | High | 7.5 | 2020-01-28 | Directory traversal vulnerability in a_getlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitr… |
CVE-2013-2474 | High | 7.5 | 2020-01-27 | Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter. |
CVE-2014-8742 | High | 7.5 | 2020-01-27 | Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to read arbitrary fi… |
CVE-2014-8741 | Critical | 9.8 | 2020-01-27 | Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitra… |
CVE-2013-6056 | High | 7.5 | 2020-01-27 | OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability |
CVE-2020-8009 | High | 7.5 | 2020-01-27 | AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file. |
CVE-2018-12476 | Medium | 4.3 | 2020-01-27 | Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a r… |
CVE-2013-1597 | Medium | 6.5 | 2020-01-24 | A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user o… |
CVE-2014-1923 | High | 7.5 | 2020-01-24 | Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x befo… |
CVE-2014-1922 | High | 7.5 | 2020-01-24 | Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow… |
CVE-2019-19893 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Directory Traversal on TCP port 8000 via the Engine Service by an unauthenticated attacker, who can access the server's… |
CVE-2013-6785 | Medium | 4.3 | 2020-01-23 | Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_n… |
CVE-2020-5221 | Medium | 6.5 | 2020-01-22 | In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and wri… |
CVE-2019-19834 | High | 7.2 | 2020-01-22 | Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script… |
CVE-2020-7211 | High | 7.5 | 2020-01-21 | tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows. |
CVE-2019-14768 | High | 8.8 | 2020-01-21 | An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to t… |
CVE-2019-14767 | High | 7.5 | 2020-01-21 | In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user t… |
CVE-2019-14766 | Medium | 6.5 | 2020-01-21 | Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem. |
CVE-2020-7246 | High | 8.8 | 2020-01-21 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionalit… |
CVE-2014-5007 | Critical | 9.8 | 2020-01-17 | Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP)… |
CVE-2019-15855 | Critical | 9.1 | 2020-01-17 | An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted… |
CVE-2019-10934 | High | 7.8 | 2020-01-16 | A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update… |
CVE-2015-6591 | Medium | 5.5 | 2020-01-15 | Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitr… |
CVE-2015-5952 | Critical | 9.8 | 2020-01-15 | Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter. |
CVE-2020-1606 | Medium | 5.4 | 2020-01-15 | A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and… |
CVE-2015-3151 | High | 7.8 | 2020-01-14 | Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary fi… |
CVE-2013-6225 | Critical | 9.8 | 2020-01-13 | LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability |
CVE-2020-5513 | Medium | 6.8 | 2020-01-06 | Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal. |
CVE-2020-5512 | Medium | 6.8 | 2020-01-06 | Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal. |
CVE-2020-5840 | High | 7.5 | 2020-01-06 | An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name o… |
CVE-2019-15982 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |
CVE-2019-15981 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |
CVE-2019-15980 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |