CWE-22 · Path Traversal (page 79)
Page 79 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-9983 | Medium | 5.5 | 2017-06-04 | Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote… |
CVE-2017-9416 | Medium | 6.5 | 2017-06-04 | Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the… |
CVE-2015-5473 | Critical | 9.8 | 2017-06-01 | Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1… |
CVE-2015-0269 | Medium | 4.3 | 2017-05-26 | Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file… |
CVE-2015-1834 | Medium | 6.5 | 2017-05-25 | A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud… |
CVE-2017-8314 | Medium | 5.5 | 2017-05-23 | Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles. |
CVE-2017-5966 | Medium | 4.9 | 2017-05-23 | Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download… |
CVE-2017-6821 | Critical | 9.8 | 2017-05-23 | Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors. |
CVE-2015-5609 | Critical | 9.1 | 2017-05-23 | Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathna… |
CVE-2015-5469 | High | 7.5 | 2017-05-23 | Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathn… |
CVE-2015-5468 | High | 7.5 | 2017-05-23 | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (d… |
CVE-2015-4704 | High | 7.5 | 2017-05-23 | Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) i… |
CVE-2017-6636 | Medium | 6.5 | 2017-05-22 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker t… |
CVE-2017-9024 | High | 7.5 | 2017-05-21 | Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its TFTP Server, allowi… |
CVE-2017-6652 | High | 7.5 | 2017-05-18 | A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an af… |
CVE-2017-3980 | High | 7.2 | 2017-05-18 | A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated u… |
CVE-2017-9067 | High | 7.0 | 2017-05-18 | In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient valid… |
CVE-2017-7433 | Medium | 6.5 | 2017-05-18 | An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from… |
CVE-2017-9031 | Critical | 9.8 | 2017-05-17 | The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associ… |
CVE-2017-9030 | High | 7.5 | 2017-05-17 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanis… |
CVE-2016-10331 | High | 7.5 | 2017-05-12 | Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathna… |
CVE-2016-10330 | High | 7.1 | 2017-05-12 | Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arb… |
CVE-2017-8921 | High | 7.5 | 2017-05-12 | In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the con… |
CVE-2017-2163 | High | 7.5 | 2017-05-12 | Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id. |
CVE-2017-8868 | High | 7.5 | 2017-05-10 | acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to… |
CVE-2017-8853 | High | 7.5 | 2017-05-09 | Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter durin… |
CVE-2017-7929 | High | 7.1 | 2017-05-06 | An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, wh… |
CVE-2017-6629 | Medium | 5.3 | 2017-05-03 | A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locatio… |
CVE-2016-10367 | High | 7.5 | 2017-05-03 | In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthen… |
CVE-2016-8593 | High | 8.8 | 2017-04-28 | Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute a… |
CVE-2017-2150 | Medium | 5.3 | 2017-04-28 | Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_cha… |
CVE-2017-2119 | High | 8.6 | 2017-04-28 | Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2017-2117 | Medium | 4.9 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors. |
CVE-2017-2098 | Medium | 6.5 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2017-2090 | Medium | 6.5 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2016-7843 | Medium | 5.5 | 2017-04-28 | Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows re… |
CVE-2016-7842 | Medium | 5.5 | 2017-04-28 | Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially craf… |
CVE-2017-8297 | Critical | 9.8 | 2017-04-27 | A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component). |
CVE-2017-8283 | Critical | 9.8 | 2017-04-26 | dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which… |
CVE-2017-8115 | Medium | 5.3 | 2017-04-25 | Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to ob… |
CVE-2017-8104 | Medium | 5.3 | 2017-04-24 | In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. |
CVE-2016-4313 | High | 7.8 | 2017-04-24 | Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archi… |
CVE-2015-7245 | High | 7.5 | 2017-04-24 | Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive informati… |
CVE-2015-0107 | Medium | 6.5 | 2017-04-24 | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo… |
CVE-2016-5312 | Medium | 6.5 | 2017-04-14 | Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary fil… |
CVE-2015-8780 | Medium | 6.4 | 2017-04-13 | Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury. |
CVE-2015-8283 | Medium | 6.5 | 2017-04-13 | Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00. |
CVE-2016-7552 | Critical | 9.8 | 2017-04-12 | On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to… |
CVE-2017-7462 | Critical | 9.8 | 2017-04-11 | Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory. |
CVE-2017-7461 | Medium | 4.9 | 2017-04-11 | Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to r… |
CVE-2017-6190 | High | 7.5 | 2017-04-10 | Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary fil… |
CVE-2016-4320 | Medium | 4.3 | 2017-04-10 | Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull reques… |
CVE-2015-7270 | High | 7.8 | 2017-04-10 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. |
CVE-2017-7577 | Critical | 9.8 | 2017-04-07 | XiongMai uc-httpd has directory traversal allowing the reading of arbitrary files via a "GET ../" HTTP request. |
CVE-2017-7565 | High | 8.8 | 2017-04-06 | Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041. |
CVE-2017-7358 | High | 7.3 | 2017-04-05 | In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate… |
CVE-2017-4980 | High | 7.5 | 2017-03-29 | EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versi… |
CVE-2017-7258 | High | 7.5 | 2017-03-29 | HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerfu… |
CVE-2017-5899 | High | 7.0 | 2017-03-27 | Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and… |
CVE-2015-8309 | Medium | 4.3 | 2017-03-27 | Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "downloa… |
CVE-2017-7240 | High | 7.5 | 2017-03-24 | An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone t… |
CVE-2017-5869 | High | 8.8 | 2017-03-24 | Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute a… |
CVE-2016-10048 | High | 7.5 | 2017-03-23 | Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors. |
CVE-2017-3851 | High | 7.5 | 2017-03-22 | A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx application environme… |
CVE-2017-6805 | Medium | 5.3 | 2017-03-20 | Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a… |
CVE-2014-8704 | Critical | 9.8 | 2017-03-17 | Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme. |
CVE-2017-6510 | High | 7.5 | 2017-03-16 | Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any f… |
CVE-2013-7462 | High | 7.5 | 2017-03-14 | A directory traversal vulnerability in the web application in McAfee (now Intel Security) SaaS Control Console (SCC) Platform 6.14 before patch 1070, and 6.15… |
CVE-2017-6527 | High | 7.5 | 2017-03-09 | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacke… |
CVE-2016-7135 | Medium | 4.9 | 2017-03-07 | Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot do… |
CVE-2016-9164 | High | 7.5 | 2017-03-07 | Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier and CA Unified Inf… |
CVE-2017-5231 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cm… |
CVE-2017-5229 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump… |
CVE-2017-5228 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() funct… |
CVE-2017-5982 | High | 7.5 | 2017-02-28 | Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash… |
CVE-2017-5946 | Critical | 9.8 | 2017-02-27 | The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker… |
CVE-2017-6306 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename functi… |
CVE-2016-4314 | Medium | 4.9 | 2017-02-17 | Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a… |
CVE-2017-5168 | High | 7.5 | 2017-02-13 | An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaw… |
CVE-2017-5163 | Medium | 5.9 | 2017-02-13 | An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an administrator downloads a configuration fil… |
CVE-2017-5143 | High | 8.6 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authe… |
CVE-2016-9364 | High | 7.5 | 2017-02-13 | An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access… |
CVE-2016-9357 | Medium | 5.3 | 2017-02-13 | An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 201… |
CVE-2016-9351 | High | 7.0 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack… |
CVE-2016-9339 | Medium | 5.3 | 2017-02-13 | An issue was discovered in INTERSCHALT Maritime Systems VDR G4e Versions 5.220 and prior. External input is used to construct paths to files and directories wi… |
CVE-2016-5803 | High | 8.6 | 2017-02-13 | An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to… |
CVE-2016-4987 | Medium | 6.5 | 2017-02-09 | Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary fi… |
CVE-2016-4986 | High | 7.5 | 2017-02-09 | Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter. |
CVE-2016-8211 | High | 7.5 | 2017-02-03 | EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection A… |
CVE-2017-5219 | Critical | 9.8 | 2017-02-02 | An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to t… |
CVE-2016-8933 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing… |
CVE-2016-5941 | Medium | 5.7 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing… |
CVE-2016-8913 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2016-6126 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2016-10173 | High | 7.5 | 2017-02-01 | Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via… |
CVE-2016-6269 | Critical | 9.1 | 2017-01-30 | Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 all… |
CVE-2016-10184 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal. |
CVE-2016-10183 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal. |
CVE-2016-7569 | Medium | 5.5 | 2017-01-27 | Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the embedded layer data… |
CVE-2016-6601 | High | 7.5 | 2017-01-23 | Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files v… |