CWE-22 · Path Traversal (page 75)
Page 75 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16157 | High | 7.5 | 2018-06-07 | censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to… |
CVE-2017-16156 | High | 7.5 | 2018-06-07 | myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16155 | High | 7.5 | 2018-06-07 | fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker… |
CVE-2017-16154 | High | 7.5 | 2018-06-07 | earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by… |
CVE-2017-16152 | High | 7.5 | 2018-06-07 | static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pla… |
CVE-2017-16150 | High | 7.5 | 2018-06-07 | wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../"… |
CVE-2017-16149 | High | 7.5 | 2018-06-07 | zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16148 | High | 7.5 | 2018-06-07 | serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16147 | High | 7.5 | 2018-06-07 | shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16146 | High | 7.5 | 2018-06-07 | mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16145 | High | 7.5 | 2018-06-07 | sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../"… |
CVE-2017-16144 | High | 7.5 | 2018-06-07 | myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl… |
CVE-2017-16143 | High | 7.5 | 2018-06-07 | commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p… |
CVE-2017-16142 | High | 7.5 | 2018-06-07 | infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16141 | High | 7.5 | 2018-06-07 | lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16140 | High | 7.5 | 2018-06-07 | lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16139 | High | 7.5 | 2018-06-07 | jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible… |
CVE-2017-16135 | High | 7.5 | 2018-06-07 | serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16134 | High | 7.5 | 2018-06-07 | http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16133 | High | 7.5 | 2018-06-07 | goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16132 | High | 7.5 | 2018-06-07 | simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem… |
CVE-2017-16131 | High | 7.5 | 2018-06-07 | unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16130 | High | 7.5 | 2018-06-07 | exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the fil… |
CVE-2017-16125 | High | 7.5 | 2018-06-07 | rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a direct… |
CVE-2017-16124 | High | 7.5 | 2018-06-07 | node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesy… |
CVE-2017-16123 | High | 7.5 | 2018-06-07 | welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16122 | High | 7.5 | 2018-06-07 | cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16121 | High | 7.5 | 2018-06-07 | datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access… |
CVE-2017-16120 | High | 7.5 | 2018-06-07 | liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16110 | High | 7.5 | 2018-06-07 | weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the file… |
CVE-2017-16109 | Medium | 5.3 | 2018-06-07 | easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the u… |
CVE-2017-16108 | High | 7.5 | 2018-06-07 | gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing… |
CVE-2017-16107 | High | 7.5 | 2018-06-07 | pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16106 | High | 7.5 | 2018-06-07 | tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16105 | High | 7.5 | 2018-06-07 | serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16104 | High | 7.5 | 2018-06-07 | citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16103 | High | 7.5 | 2018-06-07 | serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16102 | High | 7.5 | 2018-06-07 | serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16101 | High | 7.5 | 2018-06-07 | serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the UR… |
CVE-2017-16097 | High | 7.5 | 2018-06-07 | tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16096 | High | 7.5 | 2018-06-07 | serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16095 | High | 7.5 | 2018-06-07 | serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16094 | High | 7.5 | 2018-06-07 | iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16093 | High | 7.5 | 2018-06-07 | cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16092 | High | 7.5 | 2018-06-07 | Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p… |
CVE-2017-16091 | High | 7.5 | 2018-06-07 | xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem… |
CVE-2017-16090 | High | 7.5 | 2018-06-07 | fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in th… |
CVE-2017-16089 | High | 7.5 | 2018-06-07 | serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16085 | High | 7.5 | 2018-06-07 | tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16084 | High | 7.5 | 2018-06-07 | list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving… |
CVE-2017-16083 | High | 7.5 | 2018-06-07 | node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesys… |
CVE-2018-10057 | Medium | 6.5 | 2018-06-05 | The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary… |
CVE-2018-1000194 | High | 8.1 | 2018-06-05 | A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents… |
CVE-2018-8008 | Medium | 5.5 | 2018-06-05 | Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved usi… |
CVE-2017-16039 | High | 7.5 | 2018-06-04 | `hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16038 | High | 7.5 | 2018-06-04 | `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is… |
CVE-2017-16037 | High | 7.5 | 2018-06-04 | `gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL. |
CVE-2017-16036 | High | 7.5 | 2018-06-04 | `badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker ac… |
CVE-2017-16029 | High | 7.5 | 2018-06-04 | hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that… |
CVE-2017-0930 | Medium | 6.5 | 2018-06-04 | augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file w… |
CVE-2018-10615 | High | 8.1 | 2018-06-04 | Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform. |
CVE-2016-10561 | Medium | 5.3 | 2018-05-31 | Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is e… |
CVE-2016-10538 | Low | 3.5 | 2018-05-31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any f… |
CVE-2016-10528 | Medium | 4.9 | 2018-05-31 | restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up… |
CVE-2014-10066 | High | 7.5 | 2018-05-31 | Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to re… |
CVE-2018-11141 | Critical | 9.8 | 2018-05-31 | The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318… |
CVE-2018-11137 | Medium | 6.5 | 2018-05-31 | The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary… |
CVE-2018-11235 | High | 7.8 | 2018-05-30 | In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a craft… |
CVE-2018-3744 | Critical | 9.8 | 2018-05-29 | The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. |
CVE-2018-3734 | High | 7.5 | 2018-05-29 | stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file wi… |
CVE-2018-3733 | High | 7.5 | 2018-05-29 | crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read… |
CVE-2017-16153 | High | 7.5 | 2018-05-29 | gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2014-10068 | High | 7.5 | 2018-05-29 | The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false. |
CVE-2018-6409 | Medium | 5.3 | 2018-05-26 | An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of… |
CVE-2018-11495 | Medium | 4.9 | 2018-05-26 | OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download… |
CVE-2018-11494 | High | 8.0 | 2018-05-26 | The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to… |
CVE-2017-9664 | Critical | 9.8 | 2018-05-24 | In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal… |
CVE-2018-11413 | Medium | 6.5 | 2018-05-24 | An issue was discovered in BearAdmin 0.5. Remote attackers can download arbitrary files via /admin/databack/download.html?name= directory traversal sequences… |
CVE-2018-10357 | High | 8.8 | 2018-05-23 | A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable insta… |
CVE-2018-11344 | Medium | 6.5 | 2018-05-22 | A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via t… |
CVE-2018-11342 | Medium | 4.3 | 2018-05-22 | A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to… |
CVE-2018-11341 | High | 7.2 | 2018-05-22 | Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter. |
CVE-2018-11319 | High | 7.5 | 2018-05-20 | Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the… |
CVE-2018-11248 | Critical | 9.8 | 2018-05-18 | util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored i… |
CVE-2018-0323 | Medium | 6.5 | 2018-05-17 | A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduc… |
CVE-2018-7503 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7495 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10589 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-1263 | Medium | 4.7 | 2018-05-15 | Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be ach… |
CVE-2018-0588 | High | 7.5 | 2018-05-14 | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary… |
CVE-2018-0586 | Medium | 4.3 | 2018-05-14 | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attacke… |
CVE-2018-1261 | Medium | 4.7 | 2018-05-11 | Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affe… |
CVE-2018-7933 | High | 7.8 | 2018-05-10 | Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9.6 have a path trave… |
CVE-2015-1503 | High | 7.5 | 2018-05-08 | Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the fi… |
CVE-2017-2594 | Medium | 5.4 | 2018-05-08 | hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a ful… |
CVE-2018-1000175 | Medium | 6.5 | 2018-05-08 | A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the H… |
CVE-2018-5448 | Medium | 4.8 | 2018-05-04 | Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the… |
CVE-2018-8003 | Medium | 5.3 | 2018-05-03 | Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which provides… |
CVE-2018-0258 | Critical | 9.8 | 2018-05-02 | A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directo… |
CVE-2018-1102 | High | 8.8 | 2018-04-30 | A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReade… |