CWE-22 · Path Traversal (page 71)
Page 71 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20631 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file. |
CVE-2018-20630 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/up… |
CVE-2018-20629 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-c… |
CVE-2018-20628 | High | 7.5 | 2019-03-21 | PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-con… |
CVE-2018-20626 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/upload… |
CVE-2018-20525 | Critical | 9.1 | 2019-03-21 | Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. |
CVE-2018-19512 | High | 7.2 | 2019-03-21 | In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated adminis… |
CVE-2018-19365 | Critical | 9.1 | 2019-03-21 | The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP req… |
CVE-2018-11789 | High | 7.5 | 2019-03-21 | When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifyi… |
CVE-2019-3816 | High | 7.5 | 2019-03-14 | Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root d… |
CVE-2019-5923 | High | 7.5 | 2019-03-12 | Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecif… |
CVE-2019-9686 | High | 8.8 | 2019-03-11 | pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received… |
CVE-2019-9662 | High | 7.5 | 2019-03-11 | An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted via a console/cache/m… |
CVE-2013-7466 | High | 8.8 | 2019-03-07 | Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the db_type… |
CVE-2018-18809 | Medium | 6.5 | 2019-03-07 | The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Libr… |
CVE-2019-9622 | Medium | 4.3 | 2019-03-07 | eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/sa… |
CVE-2019-9611 | Medium | 6.5 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter… |
CVE-2019-9610 | Medium | 4.3 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTempl… |
CVE-2019-9607 | Medium | 5.3 | 2019-03-06 | PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file. |
CVE-2019-9195 | Critical | 9.8 | 2019-02-26 | util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive. |
CVE-2018-20795 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action i… |
CVE-2018-20794 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, th… |
CVE-2018-20793 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, th… |
CVE-2018-20792 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in… |
CVE-2018-20790 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass throu… |
CVE-2018-20789 | High | 7.5 | 2019-02-25 | tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass… |
CVE-2019-9064 | Medium | 5.3 | 2019-02-23 | PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file. |
CVE-2019-9015 | Critical | 9.1 | 2019-02-22 | A Path Traversal vulnerability was discovered in MOPCMS through 2018-11-30, leading to deletion of unexpected critical files. The exploitation point is in the… |
CVE-2019-1681 | High | 7.5 | 2019-02-21 | A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitr… |
CVE-2018-2006 | Medium | 4.9 | 2019-02-21 | IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specia… |
CVE-2019-3474 | Medium | 6.5 | 2019-02-20 | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to downl… |
CVE-2019-8943 | Medium | 6.5 | 2019-02-20 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary… |
CVE-2019-8903 | High | 7.5 | 2019-02-18 | index.js in Total.js Platform before 3.2.3 allows path traversal. |
CVE-2019-8412 | High | 8.8 | 2019-02-17 | FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-… |
CVE-2019-8411 | High | 7.5 | 2019-02-17 | admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. |
CVE-2019-8407 | Medium | 6.5 | 2019-02-17 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. |
CVE-2019-8395 | Critical | 9.8 | 2019-02-17 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a requ… |
CVE-2019-8389 | High | 8.1 | 2019-02-17 | A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, acce… |
CVE-2019-8358 | High | 8.1 | 2019-02-16 | In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled. |
CVE-2015-4617 | High | 7.5 | 2019-02-15 | Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating… |
CVE-2013-2565 | Medium | 5.3 | 2019-02-15 | A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver. |
CVE-2019-5910 | High | 7.5 | 2019-02-13 | Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2018-20769 | High | 7.5 | 2019-02-10 | An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devic… |
CVE-2019-7678 | Critical | 9.8 | 2019-02-09 | A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 8888. |
CVE-2018-20251 | Medium | 5.5 | 2019-02-05 | In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNA… |
CVE-2018-20250 | High | 7.8 | 2019-02-05 | In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When… |
CVE-2018-18990 | Medium | 5.3 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerab… |
CVE-2019-7403 | Medium | 4.9 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&t… |
CVE-2019-7387 | Medium | 6.5 | 2019-02-04 | A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. When… |
CVE-2019-1000009 | Medium | 6.5 | 2019-02-04 | Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in… |
CVE-2019-1000008 | Medium | 6.5 | 2019-02-04 | All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulner… |
CVE-2018-16493 | High | 7.5 | 2019-02-01 | A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending sla… |
CVE-2018-16485 | Medium | 6.5 | 2019-02-01 | Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd… |
CVE-2018-16482 | High | 7.5 | 2019-02-01 | A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file sy… |
CVE-2018-16479 | High | 7.5 | 2019-02-01 | Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL. |
CVE-2018-0722 | High | 7.5 | 2019-02-01 | Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could al… |
CVE-2018-19043 | Medium | 5.3 | 2019-01-31 | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the d… |
CVE-2018-19042 | Medium | 5.3 | 2019-01-31 | The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrel… |
CVE-2018-19040 | Medium | 5.3 | 2019-01-31 | The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to… |
CVE-2019-6111 | Medium | 5.9 | 2019-01-31 | An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the c… |
CVE-2019-7237 | High | 7.5 | 2019-01-30 | An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal. |
CVE-2019-7236 | High | 7.5 | 2019-01-30 | An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal. |
CVE-2019-7235 | High | 7.5 | 2019-01-30 | An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory be… |
CVE-2019-7234 | Critical | 9.1 | 2019-01-30 | An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP… |
CVE-2019-7160 | Critical | 9.8 | 2019-01-29 | idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PH… |
CVE-2018-1000997 | Medium | 6.5 | 2019-01-23 | A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke… |
CVE-2019-6500 | High | 7.5 | 2019-01-21 | In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with… |
CVE-2018-15782 | High | 7.7 | 2019-01-16 | The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A local attacker could… |
CVE-2015-9277 | Critical | 9.1 | 2019-01-16 | MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are m… |
CVE-2018-20714 | High | 8.1 | 2019-01-15 | The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of wooc… |
CVE-2019-5887 | High | 7.5 | 2019-01-10 | An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling… |
CVE-2018-16202 | High | 8.6 | 2019-01-09 | Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0)… |
CVE-2018-16171 | High | 8.8 | 2019-01-09 | Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vecto… |
CVE-2018-16170 | High | 8.1 | 2019-01-09 | Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspeci… |
CVE-2018-1000406 | Medium | 6.5 | 2019-01-09 | A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that all… |
CVE-2018-0705 | Critical | 9.1 | 2019-01-09 | Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests. |
CVE-2018-0704 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen. |
CVE-2018-0703 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests. |
CVE-2018-0702 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors. |
CVE-2015-9275 | Medium | 5.3 | 2019-01-07 | ARC 5.21q allows directory traversal via a full pathname in an archive file. |
CVE-2019-3580 | High | 7.5 | 2019-01-03 | OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file. |
CVE-2018-15490 | High | 7.1 | 2019-01-02 | An issue was discovered in ExpressVPN on Windows. The Xvpnd.exe process (which runs as a service with SYSTEM privileges) listens on TCP port 2015, which is use… |
CVE-2018-18593 | Medium | 6.5 | 2018-12-31 | Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, version 10.22, 10.22 CUP1, 10.22 CUP2, 10… |
CVE-2018-20610 | Medium | 4.9 | 2018-12-30 | imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter. |
CVE-2018-20604 | Medium | 4.9 | 2018-12-30 | Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/ed… |
CVE-2018-20566 | Medium | 5.3 | 2018-12-28 | An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted in… |
CVE-2018-20463 | High | 7.5 | 2018-12-25 | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://fil… |
CVE-2018-20437 | High | 7.5 | 2018-12-25 | An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a reque… |
CVE-2018-7835 | High | 7.5 | 2018-12-24 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files… |
CVE-2018-20332 | High | 7.5 | 2018-12-21 | An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download… |
CVE-2018-1000882 | High | 7.5 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attac… |
CVE-2018-1000857 | High | 8.8 | 2018-12-20 | log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in Us… |
CVE-2018-1000850 | High | 7.5 | 2018-12-20 | Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPat… |
CVE-2018-1000817 | High | 7.5 | 2018-12-20 | Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Application… |
CVE-2018-20303 | High | 7.5 | 2018-12-20 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessi… |
CVE-2018-20227 | High | 7.5 | 2018-12-19 | RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive. |
CVE-2018-20092 | High | 7.5 | 2018-12-17 | PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request. |
CVE-2017-18354 | High | 7.5 | 2018-12-17 | Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote… |
CVE-2018-19003 | High | 7.5 | 2018-12-14 | GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04… |
CVE-2018-16874 | High | 8.1 | 2018-12-14 | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go pa… |