CWE-22 · Path Traversal (page 72)
Page 72 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-13812 | High | 7.5 | 2018-12-13 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All vers… |
CVE-2018-20128 | High | 7.5 | 2018-12-13 | An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pat… |
CVE-2018-20094 | High | 7.5 | 2018-12-12 | An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, rela… |
CVE-2018-20064 | High | 7.5 | 2018-12-11 | doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?controller=theme&action=edit&name=doorg… |
CVE-2018-20058 | High | 7.5 | 2018-12-11 | In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634. |
CVE-2018-1000863 | High | 8.2 | 2018-12-10 | A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit cr… |
CVE-2018-19753 | High | 7.5 | 2018-12-05 | Tarantella Enterprise before 3.11 allows Directory Traversal. |
CVE-2018-19859 | Medium | 6.5 | 2018-12-05 | OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive. |
CVE-2018-12314 | High | 7.5 | 2018-12-04 | Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder"… |
CVE-2018-12309 | High | 7.5 | 2018-12-04 | Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter… |
CVE-2018-12306 | High | 7.5 | 2018-12-04 | Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar is… |
CVE-2018-16478 | Medium | 5.3 | 2018-12-04 | A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root. |
CVE-2018-14707 | High | 7.5 | 2018-12-03 | Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary l… |
CVE-2018-3949 | High | 7.5 | 2018-12-01 | An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a dire… |
CVE-2018-7807 | High | 8.8 | 2018-11-30 | Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file… |
CVE-2018-7806 | High | 8.8 | 2018-11-30 | Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly upload… |
CVE-2018-19748 | High | 7.5 | 2018-11-29 | app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory trav… |
CVE-2018-19666 | High | 7.8 | 2018-11-29 | The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the asso… |
CVE-2018-13332 | High | 7.5 | 2018-11-27 | Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL pa… |
CVE-2018-17934 | Critical | 9.8 | 2018-11-27 | NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the intended directory. T… |
CVE-2018-13322 | Medium | 6.5 | 2018-11-26 | Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter. |
CVE-2018-19329 | Medium | 4.9 | 2018-11-17 | GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfileh… |
CVE-2018-19328 | Critical | 9.8 | 2018-11-17 | LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal. |
CVE-2018-19326 | High | 7.5 | 2018-11-17 | Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd. |
CVE-2018-1797 | Medium | 6.3 | 2018-11-16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the syst… |
CVE-2018-0693 | High | 7.5 | 2018-11-15 | Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory in FileZen via unsp… |
CVE-2018-0673 | High | 8.1 | 2018-11-15 | Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2018-8009 | High | 8.8 | 2018-11-13 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerabilit… |
CVE-2018-19228 | High | 7.5 | 2018-11-12 | An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by… |
CVE-2018-1884 | Medium | 4.8 | 2018-11-12 | IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerable to a "zip slip" vulnerability which could allow a remote attacker to ex… |
CVE-2018-19197 | Medium | 4.9 | 2018-11-12 | An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=… |
CVE-2018-19181 | High | 7.5 | 2018-11-11 | statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key paramet… |
CVE-2018-19124 | High | 7.5 | 2018-11-09 | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files. |
CVE-2018-15450 | Medium | 6.5 | 2018-11-08 | A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system… |
CVE-2018-19052 | High | 7.5 | 2018-11-07 | An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory abo… |
CVE-2018-16475 | High | 7.5 | 2018-11-06 | A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server. |
CVE-2018-16473 | Medium | 5.3 | 2018-11-06 | A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files. |
CVE-2018-9459 | High | 8.8 | 2018-11-06 | In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traversal error. This… |
CVE-2018-9445 | Medium | 6.8 | 2018-11-06 | In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a… |
CVE-2018-18950 | High | 7.5 | 2018-11-05 | KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder v… |
CVE-2018-18936 | High | 7.5 | 2018-11-05 | An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route… |
CVE-2018-18777 | Medium | 4.3 | 2018-11-01 | Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users… |
CVE-2018-18890 | Medium | 5.3 | 2018-11-01 | MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename. |
CVE-2018-15706 | Medium | 6.5 | 2018-10-31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vu… |
CVE-2018-15705 | Medium | 6.5 | 2018-10-31 | WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a director… |
CVE-2018-11759 | High | 7.5 | 2018-10-31 | The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector… |
CVE-2018-14654 | Medium | 6.5 | 2018-10-31 | The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could e… |
CVE-2018-18869 | Critical | 9.8 | 2018-10-31 | EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php… |
CVE-2018-18831 | High | 7.5 | 2018-10-30 | An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbi… |
CVE-2018-18713 | High | 7.5 | 2018-10-29 | The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m… |
CVE-2018-18703 | High | 7.5 | 2018-10-29 | PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read… |
CVE-2016-10733 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. |
CVE-2018-18552 | Medium | 6.5 | 2018-10-24 | ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK file that points t… |
CVE-2018-15750 | Medium | 5.3 | 2018-10-24 | Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files e… |
CVE-2018-7431 | Medium | 6.5 | 2018-10-23 | Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3… |
CVE-2018-17444 | High | 7.5 | 2018-10-23 | A Directory Traversal issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-14806 | Critical | 9.8 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code. |
CVE-2018-18586 | Medium | 5.3 | 2018-10-23 | chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files… |
CVE-2018-18485 | High | 7.5 | 2018-10-18 | An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbna… |
CVE-2015-4632 | High | 7.5 | 2018-10-18 | Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote… |
CVE-2018-0420 | Medium | 6.5 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive informatio… |
CVE-2018-10824 | Critical | 9.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 throu… |
CVE-2018-10822 | High | 7.5 | 2018-10-17 | Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-… |
CVE-2018-18434 | High | 7.5 | 2018-10-17 | An issue was discovered in litemall 0.9.0. Arbitrary file download is possible via ../ directory traversal in linlinjava/litemall/wx/web/WxStorageController.ja… |
CVE-2018-17899 | High | 8.8 | 2018-10-17 | LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution. |
CVE-2018-15540 | Critical | 9.8 | 2018-10-15 | Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations… |
CVE-2018-1744 | High | 7.7 | 2018-10-15 | IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a special… |
CVE-2018-18323 | High | 7.5 | 2018-10-15 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../… |
CVE-2018-1770 | Medium | 6.5 | 2018-10-12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially… |
CVE-2018-18257 | High | 7.5 | 2018-10-11 | An issue was discovered in BageCMS 3.1.3. An attacker can delete any files and folders on the web server via an index.php?r=admini/template/batch&command=delet… |
CVE-2018-12542 | Critical | 9.8 | 2018-10-10 | In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, b… |
CVE-2018-8495 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects… |
CVE-2018-0405 | High | 7.5 | 2018-10-05 | A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Fi… |
CVE-2018-0464 | High | 8.1 | 2018-10-05 | A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain acc… |
CVE-2018-0426 | Critical | 9.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-1649 | High | 7.7 | 2018-10-05 | IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL r… |
CVE-2018-16457 | Medium | 5.3 | 2018-10-04 | PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img directory. |
CVE-2018-17553 | High | 8.8 | 2018-10-03 | An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated at… |
CVE-2018-12473 | Low | 3.1 | 2018-10-02 | A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. O… |
CVE-2018-17838 | High | 7.5 | 2018-10-01 | An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file read operations are possible via a /console/#/console/file/manage.php?type=list&path=c:/ substring. |
CVE-2018-17837 | High | 7.5 | 2018-10-01 | An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substri… |
CVE-2018-17836 | High | 8.8 | 2018-10-01 | An issue was discovered in JTBC(PHP) 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=a… |
CVE-2018-17828 | Medium | 5.5 | 2018-10-01 | Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function un… |
CVE-2018-17798 | Medium | 6.5 | 2018-09-30 | An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in a… |
CVE-2018-17797 | Medium | 6.5 | 2018-09-30 | An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg paramet… |
CVE-2018-17785 | High | 7.5 | 2018-09-30 | In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by readi… |
CVE-2018-9074 | Medium | 6.5 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnera… |
CVE-2018-17605 | High | 7.5 | 2018-09-28 | An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-… |
CVE-2018-14957 | Critical | 9.8 | 2018-09-28 | CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_documenti/../.././inc/con… |
CVE-2018-7102 | High | 7.5 | 2018-09-27 | A security vulnerability in HPE Intelligent Management Center (iMC) PLAT E0506P09, createFabricAutoCfgFile could be remotely exploited via directory traversal… |
CVE-2018-17365 | High | 7.5 | 2018-09-26 | SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter. |
CVE-2018-16968 | Low | 3.1 | 2018-09-26 | Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal. |
CVE-2018-10501 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must firs… |
CVE-2018-16299 | High | 7.5 | 2018-09-24 | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. |
CVE-2018-16283 | Critical | 9.8 | 2018-09-24 | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. |
CVE-2018-17297 | High | 7.5 | 2018-09-21 | The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename… |
CVE-2018-6500 | High | 7.5 | 2018-09-20 | A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerabil… |
CVE-2018-8889 | Medium | 4.7 | 2018-09-19 | A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could allow an attacker to… |
CVE-2018-11762 | Medium | 5.9 | 2018-09-19 | In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has a… |
CVE-2018-16820 | High | 7.5 | 2018-09-18 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. |