CWE-22 · Path Traversal (page 78)
Page 78 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15079 | High | 7.5 | 2017-10-06 | The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. |
CVE-2017-13996 | High | 8.8 | 2017-10-05 | A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files tha… |
CVE-2017-12263 | High | 7.5 | 2017-10-05 | A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view files within the ap… |
CVE-2017-14754 | Medium | 6.5 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitra… |
CVE-2017-13985 | Medium | 6.5 | 2017-09-30 | An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users… |
CVE-2017-13982 | High | 8.8 | 2017-09-30 | A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to… |
CVE-2017-1577 | High | 7.5 | 2017-09-28 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2017-14849 | High | 7.5 | 2017-09-28 | Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation… |
CVE-2017-7974 | Critical | 9.8 | 2017-09-26 | A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthentic… |
CVE-2017-14722 | High | 7.5 | 2017-09-23 | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. |
CVE-2017-14719 | High | 7.5 | 2017-09-23 | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. |
CVE-2017-8007 | High | 8.8 | 2017-09-22 | In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. A… |
CVE-2016-6795 | Critical | 9.8 | 2017-09-20 | In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path trav… |
CVE-2015-4074 | High | 7.5 | 2017-09-20 | Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the… |
CVE-2017-10931 | High | 7.5 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files… |
CVE-2017-14514 | High | 7.5 | 2017-09-17 | Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL. |
CVE-2017-14513 | Medium | 5.3 | 2017-09-17 | Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fing… |
CVE-2017-11162 | Medium | 6.5 | 2017-09-08 | Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary fi… |
CVE-2015-4085 | High | 7.5 | 2017-09-07 | Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. |
CVE-2017-14120 | High | 7.5 | 2017-09-03 | unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../[filename] are unpacke… |
CVE-2014-8676 | Medium | 5.3 | 2017-08-31 | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitr… |
CVE-2017-0901 | High | 7.5 | 2017-08-31 | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesyst… |
CVE-2017-13780 | High | 7.5 | 2017-08-30 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file p… |
CVE-2017-3163 | High | 7.5 | 2017-08-30 | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However… |
CVE-2017-2258 | Medium | 4.3 | 2017-08-29 | Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHandleApplications". |
CVE-2017-10841 | Medium | 4.9 | 2017-08-29 | Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2017-10834 | Medium | 6.5 | 2017-08-29 | Directory traversal vulnerability in "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to read arbitrary files via… |
CVE-2014-8163 | Medium | 6.5 | 2017-08-28 | Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5. |
CVE-2015-1876 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in ES File Explorer 3.2.4.1. |
CVE-2015-1386 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in unshield 1.0-1. |
CVE-2015-1199 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in ppmd 10.1-5. |
CVE-2015-1198 | High | 7.5 | 2017-08-28 | Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5. |
CVE-2014-8871 | High | 7.5 | 2017-08-28 | Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2… |
CVE-2014-5302 | High | 8.8 | 2017-08-28 | Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4… |
CVE-2014-5301 | High | 8.8 | 2017-08-28 | Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. |
CVE-2017-7693 | Medium | 6.5 | 2017-08-26 | Directory traversal vulnerability in viewer_script.jsp in Riverbed OPNET App Response Xpert (ARX) version 9.6.1 allows remote authenticated users to inject arb… |
CVE-2017-9640 | Medium | 6.3 | 2017-08-25 | A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prio… |
CVE-2017-12694 | High | 7.5 | 2017-08-25 | A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traver… |
CVE-2015-4181 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the v… |
CVE-2015-4180 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the v… |
CVE-2015-1395 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with… |
CVE-2015-8352 | Critical | 9.8 | 2017-08-24 | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act paramete… |
CVE-2017-9511 | High | 7.5 | 2017-08-24 | The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traver… |
CVE-2017-12074 | Medium | 6.5 | 2017-08-24 | Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to w… |
CVE-2017-12791 | Critical | 9.8 | 2017-08-23 | Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect… |
CVE-2017-7424 | Medium | 6.5 | 2017-08-21 | A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Upd… |
CVE-2017-12943 | Critical | 9.8 | 2017-08-18 | D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal att… |
CVE-2017-10665 | High | 7.8 | 2017-08-18 | Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitrary code by uploadin… |
CVE-2017-12938 | High | 7.5 | 2017-08-18 | UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink t… |
CVE-2017-7675 | High | 7.5 | 2017-08-11 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal at… |
CVE-2015-0781 | Critical | 9.8 | 2017-08-09 | Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload… |
CVE-2017-11152 | High | 7.5 | 2017-08-08 | Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary… |
CVE-2017-12637 | High | 7.5 | 2017-08-07 | Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers t… |
CVE-2011-5325 | High | 7.5 | 2017-08-07 | Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working d… |
CVE-2017-6758 | Medium | 6.5 | 2017-08-07 | A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary… |
CVE-2017-12586 | Medium | 6.5 | 2017-08-06 | SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by… |
CVE-2017-10949 | High | 7.5 | 2017-08-04 | Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly valida… |
CVE-2017-7442 | High | 8.8 | 2017-08-03 | Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. |
CVE-2017-11389 | Critical | 9.8 | 2017-08-02 | Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing dir… |
CVE-2017-11723 | High | 7.5 | 2017-07-29 | Directory traversal vulnerability in plugins/ImageManager/backend.php in Xinha 0.96, as used in Jojo 4.4.0, allows remote attackers to delete any folder via di… |
CVE-2017-11658 | High | 7.5 | 2017-07-26 | In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficien… |
CVE-2017-11630 | High | 7.5 | 2017-07-26 | dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file… |
CVE-2017-8033 | High | 7.8 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A… |
CVE-2015-1847 | High | 7.5 | 2017-07-25 | Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files v… |
CVE-2017-11589 | Critical | 9.8 | 2017-07-24 | On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2… |
CVE-2017-11587 | High | 7.5 | 2017-07-24 | On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2… |
CVE-2016-10400 | High | 7.5 | 2017-07-22 | Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary fil… |
CVE-2017-10993 | High | 8.8 | 2017-07-21 | Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Direct… |
CVE-2017-11500 | High | 7.5 | 2017-07-20 | A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/syste… |
CVE-2017-11469 | High | 7.5 | 2017-07-20 | get2post.php in IDERA Uptime Monitor 7.8 has directory traversal in the file_name parameter. |
CVE-2017-11456 | High | 7.5 | 2017-07-19 | Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file. |
CVE-2017-11440 | Medium | 4.9 | 2017-07-19 | In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference paramete… |
CVE-2017-10708 | High | 7.8 | 2017-07-18 | An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific h… |
CVE-2017-2240 | Medium | 6.5 | 2017-07-17 | Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web… |
CVE-2017-11348 | Medium | 5.7 | 2017-07-17 | In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, pot… |
CVE-2017-1000062 | High | 7.5 | 2017-07-17 | kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution |
CVE-2017-1000047 | Critical | 9.8 | 2017-07-17 | rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution |
CVE-2017-1000028 | High | 7.5 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploit… |
CVE-2017-1000026 | High | 7.5 | 2017-07-17 | Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using… |
CVE-2017-1000002 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution… |
CVE-2017-8003 | Medium | 4.9 | 2017-07-09 | EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vuln… |
CVE-2014-7954 | Medium | 4.6 | 2017-07-07 | Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically proximate attacker… |
CVE-2015-3297 | High | 7.5 | 2017-07-07 | Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replace… |
CVE-2017-2245 | Medium | 5.0 | 2017-07-07 | Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2017-10974 | High | 7.5 | 2017-07-07 | Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial… |
CVE-2017-6704 | Medium | 6.5 | 2017-07-04 | A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary fi… |
CVE-2015-7780 | Medium | 6.5 | 2017-06-27 | Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. |
CVE-2017-9846 | High | 8.8 | 2017-06-24 | Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php f… |
CVE-2017-9833 | High | 7.5 | 2017-06-24 | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multi… |
CVE-2017-9829 | High | 7.5 | 2017-06-23 | '/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on… |
CVE-2017-2829 | Medium | 6.5 | 2017-06-21 | An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.5… |
CVE-2017-9097 | Critical | 9.1 | 2017-06-16 | In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through… |
CVE-2017-6681 | High | 7.5 | 2017-06-13 | A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative pat… |
CVE-2016-7826 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files v… |
CVE-2016-7825 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files v… |
CVE-2016-7802 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2015-8235 | High | 7.5 | 2017-06-07 | Directory traversal vulnerability in Spiffy before 5.4. |
CVE-2015-7888 | High | 7.5 | 2017-06-07 | Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbi… |
CVE-2017-8841 | High | 8.1 | 2017-06-05 | Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-… |
CVE-2017-9428 | High | 7.5 | 2017-06-04 | A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attacker… |