CWE-22 · Path Traversal (page 69)
Page 69 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14798 | Medium | 4.9 | 2019-08-09 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action… |
CVE-2019-14312 | Medium | 6.5 | 2019-08-09 | Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker t… |
CVE-2019-1952 | Medium | 6.7 | 2019-08-08 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary… |
CVE-2019-14701 | High | 7.5 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Pat… |
CVE-2019-14700 | High | 7.5 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Tra… |
CVE-2019-14521 | High | 7.5 | 2019-08-05 | The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via pa… |
CVE-2019-7859 | High | 7.5 | 2019-08-02 | A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in un… |
CVE-2017-18448 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2016-10828 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). |
CVE-2019-10185 | High | 8.6 | 2019-07-31 | It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could u… |
CVE-2019-10182 | High | 8.2 | 2019-07-31 | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into… |
CVE-2019-14452 | High | 7.5 | 2019-07-31 | Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that i… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-10152 | High | 7.2 | 2019-07-30 | A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has comprom… |
CVE-2019-13635 | Critical | 9.1 | 2019-07-30 | The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. |
CVE-2019-14418 | High | 8.8 | 2019-07-29 | An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a… |
CVE-2019-6726 | Medium | 6.5 | 2019-07-29 | The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_f… |
CVE-2019-1020001 | High | 7.5 | 2019-07-29 | yard before 0.9.20 allows path traversal. |
CVE-2019-14362 | Medium | 5.4 | 2019-07-28 | Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the ser… |
CVE-2019-14322 | High | 7.5 | 2019-07-28 | In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. |
CVE-2019-10265 | High | 7.5 | 2019-07-26 | An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the di… |
CVE-2019-13385 | Medium | 4.3 | 2019-07-26 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and che… |
CVE-2019-1010205 | High | 7.5 | 2019-07-23 | LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attack… |
CVE-2019-14240 | High | 8.1 | 2019-07-23 | WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI. |
CVE-2019-14206 | High | 7.5 | 2019-07-21 | An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via… |
CVE-2019-14205 | High | 7.5 | 2019-07-21 | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via th… |
CVE-2019-1010151 | Critical | 9.8 | 2019-07-19 | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. |
CVE-2019-13584 | Medium | 5.3 | 2019-07-17 | The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request. |
CVE-2019-10352 | Medium | 6.5 | 2019-07-17 | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attacke… |
CVE-2019-4430 | High | 7.5 | 2019-07-17 | IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request con… |
CVE-2019-13623 | High | 7.8 | 2019-07-17 | In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file… |
CVE-2019-12990 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal. |
CVE-2019-0887 | High | 8.0 | 2019-07-15 | A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard… |
CVE-2019-5447 | Medium | 5.3 | 2019-07-15 | A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders. |
CVE-2019-3415 | Medium | 5.7 | 2019-07-11 | ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files. |
CVE-2019-9886 | High | 7.5 | 2019-07-11 | Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version… |
CVE-2019-5444 | Medium | 5.3 | 2019-07-10 | Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder. |
CVE-2019-5221 | Medium | 6.5 | 2019-07-10 | There is a path traversal vulnerability on Huawei Share. The software does not properly validate the path, an attacker could crafted a file path when transport… |
CVE-2019-13396 | Medium | 5.3 | 2019-07-10 | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POS… |
CVE-2019-12925 | High | 8.1 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially rea… |
CVE-2019-13241 | High | 7.8 | 2019-07-04 | FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive ent… |
CVE-2019-10717 | High | 7.1 | 2019-07-03 | BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter. |
CVE-2019-10137 | High | 8.1 | 2019-07-02 | A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated at… |
CVE-2019-7254 | High | 7.5 | 2019-07-02 | Linear eMerge E3-Series devices allow File Inclusion. |
CVE-2019-7253 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Directory Traversal. |
CVE-2019-7267 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Cookie Path Traversal. |
CVE-2019-11826 | High | 8.0 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary… |
CVE-2019-11822 | Medium | 4.3 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upl… |
CVE-2019-10985 | Critical | 9.1 | 2019-06-28 | In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in f… |
CVE-2018-14918 | High | 7.5 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. |
CVE-2019-3632 | High | 8.8 | 2019-06-27 | Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated pr… |
CVE-2019-7227 | High | 7.3 | 2019-06-27 | In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functio… |
CVE-2019-4252 | High | 7.5 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2019-1621 | High | 7.5 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain acces… |
CVE-2019-1620 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-10720 | High | 8.8 | 2019-06-21 | BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists becau… |
CVE-2019-10719 | High | 8.8 | 2019-06-21 | BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEng… |
CVE-2019-12901 | High | 8.8 | 2019-06-20 | Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an… |
CVE-2019-3737 | High | 7.5 | 2019-06-19 | Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the… |
CVE-2018-16594 | High | 8.1 | 2019-06-19 | The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal. |
CVE-2018-18863 | Medium | 6.5 | 2019-06-19 | NGA ResourceLink 20.0.2.1 allows local file inclusion. |
CVE-2019-4384 | Medium | 4.3 | 2019-06-19 | IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request contain… |
CVE-2019-10257 | High | 7.5 | 2019-06-19 | Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation)… |
CVE-2018-18876 | Medium | 5.3 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the… |
CVE-2017-9386 | Medium | 6.5 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to ret… |
CVE-2017-9382 | Medium | 6.5 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2019-7315 | High | 7.5 | 2019-06-17 | Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated… |
CVE-2018-20470 | High | 7.5 | 2019-06-17 | An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module… |
CVE-2019-12146 | Critical | 9.1 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw… |
CVE-2019-12145 | High | 7.5 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using spec… |
CVE-2019-12144 | Critical | 9.8 | 2019-06-11 | An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerab… |
CVE-2019-12143 | Medium | 5.3 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using spec… |
CVE-2019-12477 | Medium | 5.5 | 2019-06-07 | Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication… |
CVE-2019-8320 | High | 7.4 | 2019-06-06 | A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-c… |
CVE-2019-9157 | Medium | 5.7 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure. |
CVE-2019-8385 | Critical | 9.8 | 2019-06-05 | An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the T… |
CVE-2019-12276 | High | 7.5 | 2019-06-05 | A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to r… |
CVE-2019-9642 | Critical | 9.8 | 2019-06-05 | An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by pl… |
CVE-2019-5356 | Critical | 9.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-13379 | Critical | 9.1 | 2019-06-04 | An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and Fo… |
CVE-2019-10009 | Medium | 6.5 | 2019-06-03 | A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file… |
CVE-2019-12169 | High | 8.8 | 2019-06-03 | ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/la… |
CVE-2019-6754 | High | 7.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exp… |
CVE-2019-12310 | Critical | 9.8 | 2019-06-03 | ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view… |
CVE-2019-12593 | High | 7.5 | 2019-06-03 | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. |
CVE-2019-3397 | Critical | 9.1 | 2019-06-03 | Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed… |
CVE-2019-9106 | Critical | 9.8 | 2019-05-31 | The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php file… |
CVE-2019-10038 | High | 7.8 | 2019-05-31 | Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.a… |
CVE-2019-9723 | High | 7.1 | 2019-05-30 | LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the cl… |
CVE-2019-12459 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2019-12458 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2019-12457 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2018-16221 | High | 8.0 | 2019-05-29 | The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path trave… |
CVE-2019-9858 | High | 8.8 | 2019-05-29 | Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in… |
CVE-2016-10759 | Critical | 9.8 | 2019-05-24 | The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php b… |
CVE-2016-10751 | High | 7.2 | 2019-05-24 | osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administra… |
CVE-2019-12314 | Critical | 9.8 | 2019-05-24 | Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/Maco… |
CVE-2019-12309 | Medium | 4.9 | 2019-05-23 | dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction… |