CWE-22 · Path Traversal (page 77)
Page 77 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1279 | Medium | 6.5 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-cra… |
CVE-2018-5997 | Critical | 9.8 | 2018-01-25 | An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it is possi… |
CVE-2018-5445 | Medium | 5.3 | 2018-01-25 | A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read access to files within the directory s… |
CVE-2018-1048 | High | 7.5 | 2018-01-24 | It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / a… |
CVE-2018-1047 | Medium | 5.5 | 2018-01-24 | A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method… |
CVE-2018-6184 | High | 7.5 | 2018-01-24 | ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. |
CVE-2018-6022 | Medium | 6.5 | 2018-01-23 | Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files… |
CVE-2017-16610 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required… |
CVE-2017-16606 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73… |
CVE-2017-16605 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16604 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16603 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73… |
CVE-2017-16601 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16600 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although au… |
CVE-2017-16599 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16598 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2… |
CVE-2017-16597 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Auth… |
CVE-2017-16596 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16595 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16593 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16592 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16591 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 10… |
CVE-2017-10273 | Medium | 4.7 | 2018-01-18 | Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 1… |
CVE-2014-9485 | Medium | 5.5 | 2018-01-16 | Directory traversal vulnerability in the do_extract_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to writ… |
CVE-2018-5700 | High | 8.8 | 2018-01-14 | Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/… |
CVE-2015-9250 | High | 7.5 | 2018-01-12 | An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/fil… |
CVE-2014-5068 | High | 7.5 | 2018-01-11 | Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot sl… |
CVE-2017-17662 | High | 7.5 | 2018-01-10 | Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or… |
CVE-2017-1671 | High | 7.5 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-craf… |
CVE-2018-5310 | Medium | 6.5 | 2018-01-09 | In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-se… |
CVE-2018-5283 | High | 7.5 | 2018-01-08 | The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php. |
CVE-2018-5291 | High | 7.5 | 2018-01-08 | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. |
CVE-2018-5290 | High | 7.5 | 2018-01-08 | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. |
CVE-2018-5289 | High | 7.5 | 2018-01-08 | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page. |
CVE-2018-5287 | High | 7.5 | 2018-01-08 | The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page. |
CVE-2017-15550 | High | 8.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2017-16720 | Critical | 9.8 | 2018-01-05 | A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target dev… |
CVE-2017-1000472 | Medium | 6.5 | 2018-01-03 | The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header… |
CVE-2017-1000490 | Medium | 6.5 | 2018-01-03 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download an… |
CVE-2017-1000501 | Critical | 9.8 | 2018-01-03 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated re… |
CVE-2017-1000448 | High | 7.5 | 2018-01-02 | Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possibility of disclosin… |
CVE-2017-9965 | Medium | 5.8 | 2018-01-02 | An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. Using a directory travers… |
CVE-2017-9964 | Medium | 6.9 | 2018-01-02 | A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communications, an unauthorized… |
CVE-2017-17992 | Critical | 9.8 | 2017-12-30 | Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a down… |
CVE-2015-7669 | Critical | 9.8 | 2017-12-27 | Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPr… |
CVE-2017-17927 | Medium | 5.3 | 2017-12-27 | PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category… |
CVE-2017-17924 | Medium | 5.3 | 2017-12-27 | PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.ph… |
CVE-2017-15309 | High | 7.1 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulne… |
CVE-2017-10907 | Medium | 4.3 | 2017-12-22 | Directory traversal vulnerability in OneThird CMS Show Off v1.85 and earlier. Show Off v1.85 en and earlier allows an attacker to read arbitrary files via unsp… |
CVE-2017-5261 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path… |
CVE-2017-15532 | Medium | 5.7 | 2017-12-20 | Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to ac… |
CVE-2017-17739 | Critical | 9.8 | 2017-12-18 | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to r… |
CVE-2017-17715 | High | 8.8 | 2017-12-16 | The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtai… |
CVE-2017-16788 | High | 7.2 | 2017-12-15 | Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24… |
CVE-2017-17671 | Critical | 9.8 | 2017-12-14 | vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include d… |
CVE-2017-1548 | Medium | 5.3 | 2017-12-11 | IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request conta… |
CVE-2017-15895 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to wri… |
CVE-2017-15894 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows… |
CVE-2017-15893 | Medium | 6.5 | 2017-12-08 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitra… |
CVE-2017-16929 | High | 8.1 | 2017-12-05 | The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a… |
CVE-2017-10861 | Critical | 9.1 | 2017-12-01 | Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command. |
CVE-2017-15607 | Critical | 9.8 | 2017-12-01 | Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181. |
CVE-2017-14196 | High | 7.5 | 2017-11-30 | An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge… |
CVE-2017-17058 | High | 7.5 | 2017-11-29 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whi… |
CVE-2017-17042 | High | 7.5 | 2017-11-28 | lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct dir… |
CVE-2017-16959 | Medium | 6.5 | 2017-11-27 | The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary… |
CVE-2017-16936 | Medium | 6.5 | 2017-11-24 | Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC1… |
CVE-2017-8189 | Medium | 6.0 | 2017-11-22 | FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may explo… |
CVE-2017-2706 | High | 7.1 | 2017-11-22 | Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name durin… |
CVE-2017-2695 | Medium | 5.5 | 2017-11-22 | TIT-AL00C583B211 has a directory traversal vulnerability which allows an attacker to obtain the files in email application. |
CVE-2017-2693 | High | 7.8 | 2017-11-22 | ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B… |
CVE-2017-16903 | Critical | 9.8 | 2017-11-20 | LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction wit… |
CVE-2017-15527 | Medium | 6.8 | 2017-11-20 | Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there… |
CVE-2017-1000170 | High | 7.5 | 2017-11-17 | jqueryFileTree 2.1.5 and older Directory Traversal |
CVE-2017-16877 | High | 7.5 | 2017-11-17 | ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. |
CVE-2017-1087 | High | 7.8 | 2017-11-16 | In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and m… |
CVE-2017-16806 | High | 7.5 | 2017-11-13 | The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal. |
CVE-2017-16762 | High | 7.5 | 2017-11-10 | Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring. |
CVE-2017-16759 | Medium | 5.9 | 2017-11-09 | The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php. |
CVE-2017-11512 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the… |
CVE-2017-11511 | High | 7.5 | 2017-11-08 | The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for… |
CVE-2017-10940 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-… |
CVE-2014-0115 | High | 7.5 | 2017-10-30 | Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file para… |
CVE-2017-14695 | Critical | 9.8 | 2017-10-24 | Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows re… |
CVE-2014-3744 | High | 7.5 | 2017-10-23 | Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a… |
CVE-2017-9947 | Medium | 5.3 | 2017-10-23 | A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability… |
CVE-2017-15805 | High | 7.5 | 2017-10-23 | Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter… |
CVE-2017-15647 | High | 7.5 | 2017-10-19 | On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value. |
CVE-2017-10933 | High | 7.5 | 2017-10-19 | All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows… |
CVE-2017-12285 | Medium | 5.3 | 2017-10-19 | A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from a… |
CVE-2017-15359 | Medium | 6.5 | 2017-10-18 | In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/Do… |
CVE-2017-8805 | Critical | 9.1 | 2017-10-17 | Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted u… |
CVE-2017-9367 | Critical | 9.8 | 2017-10-16 | A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the… |
CVE-2014-3702 | Critical | 9.1 | 2017-10-16 | Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of serv… |
CVE-2017-15363 | High | 7.5 | 2017-10-15 | Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 f… |
CVE-2017-15276 | High | 8.8 | 2017-10-13 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user t… |
CVE-2017-12188 | High | 7.8 | 2017-10-11 | arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a gues… |
CVE-2015-2856 | High | 7.5 | 2017-10-10 | Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attac… |
CVE-2017-14614 | Medium | 6.5 | 2017-10-10 | Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remo… |
CVE-2015-1429 | High | 7.5 | 2017-10-06 | Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitr… |