CWE-22 · Path Traversal (page 80)
Page 80 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6600 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbit… |
CVE-2016-6517 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir p… |
CVE-2017-5182 | High | 7.5 | 2017-01-23 | Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows com… |
CVE-2017-5539 | Critical | 9.1 | 2017-01-23 | The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter… |
CVE-2017-5541 | Medium | 5.3 | 2017-01-20 | Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files v… |
CVE-2016-5725 | Medium | 5.9 | 2017-01-19 | Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbit… |
CVE-2016-6896 | High | 7.1 | 2017-01-18 | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated us… |
CVE-2016-7982 | High | 7.5 | 2017-01-18 | Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the… |
CVE-2016-2087 | High | 7.4 | 2017-01-18 | Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server… |
CVE-2017-5480 | High | 8.1 | 2017-01-15 | Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files… |
CVE-2016-8207 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remot… |
CVE-2016-8206 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow r… |
CVE-2016-8205 | Critical | 9.8 | 2017-01-14 | A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow r… |
CVE-2016-8204 | Critical | 9.8 | 2017-01-14 | A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote att… |
CVE-2016-3151 | High | 7.5 | 2017-01-12 | Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with fi… |
CVE-2016-4323 | Low | 3.7 | 2017-01-06 | A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an ov… |
CVE-2016-7169 | Medium | 6.3 | 2017-01-05 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in Word… |
CVE-2016-10106 | Medium | 6.5 | 2017-01-03 | Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 devices with firmware before 4.3.3-8 allows re… |
CVE-2016-9878 | High | 7.5 | 2016-12-29 | An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not p… |
CVE-2016-7087 | Medium | 5.3 | 2016-12-29 | Directory traversal vulnerability in the Connection Server in VMware Horizon View 5.x before 5.3.7, 6.x before 6.2.3, and 7.x before 7.0.1 allows remote attack… |
CVE-2016-10039 | High | 7.3 | 2016-12-24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation… |
CVE-2016-10038 | High | 7.3 | 2016-12-24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation… |
CVE-2016-10037 | High | 7.3 | 2016-12-24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation… |
CVE-2016-9950 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields ar… |
CVE-2016-8827 | Medium | 6.5 | 2016-12-16 | NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks p… |
CVE-2016-9210 | High | 7.5 | 2016-12-14 | A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthenticated, remote attacke… |
CVE-2016-9208 | Medium | 6.5 | 2016-12-14 | A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenti… |
CVE-2016-9199 | Medium | 6.5 | 2016-12-14 | A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a target… |
CVE-2016-6614 | Medium | 6.8 | 2016-12-11 | An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution… |
CVE-2016-7116 | Medium | 6.0 | 2016-12-10 | Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export pat… |
CVE-2016-6321 | High | 7.5 | 2016-12-09 | Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection… |
CVE-2016-2933 | Medium | 6.8 | 2016-11-30 | Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted re… |
CVE-2016-5765 | Medium | 6.5 | 2016-11-29 | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) a… |
CVE-2016-9177 | High | 7.5 | 2016-11-04 | Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI. |
CVE-2016-1000112 | Critical | 9.1 | 2016-10-06 | Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin |
CVE-2015-1000006 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in recent-backups v0.7 wordpress plugin |
CVE-2015-1000005 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin |
CVE-2016-6023 | High | 7.5 | 2016-10-06 | Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 a… |
CVE-2016-8343 | High | 7.5 | 2016-10-05 | Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-8280 | Medium | 6.5 | 2016-10-03 | Directory traversal vulnerability in Huawei eSight before V300R003C20SPC005 allows remote authenticated users to read arbitrary files via unspecified vectors. |
CVE-2016-6038 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.3, 6.1, and 7.1, allows remote authentic… |
CVE-2016-5970 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users… |
CVE-2016-6371 | High | 7.5 | 2016-09-12 | Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers… |
CVE-2016-6370 | Medium | 4.3 | 2016-09-12 | Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authentica… |
CVE-2016-5332 | Medium | 5.3 | 2016-08-31 | Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vecto… |
CVE-2016-5664 | Medium | 4.3 | 2016-08-26 | Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI. |
CVE-2016-5049 | High | 7.5 | 2016-08-26 | Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID para… |
CVE-2016-1429 | High | 7.5 | 2016-08-08 | Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via a crafted HTTP req… |
CVE-2016-6138 | Critical | 9.8 | 2016-08-05 | Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2… |
CVE-2016-5639 | High | 7.5 | 2016-08-03 | Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitr… |
CVE-2016-6232 | High | 7.5 | 2016-08-02 | Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot sl… |
CVE-2016-1610 | High | 7.5 | 2016-08-01 | Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote atta… |
CVE-2016-1605 | Medium | 6.5 | 2016-08-01 | Directory traversal vulnerability in the ReportViewServlet servlet in the server in NetIQ Sentinel 7.4.x before 7.4.2 allows remote attackers to read arbitrary… |
CVE-2016-5092 | Medium | 4.9 | 2016-07-13 | Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary… |
CVE-2016-2205 | Medium | 5.7 | 2016-07-12 | Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1… |
CVE-2016-5098 | Medium | 5.3 | 2016-07-05 | Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of… |
CVE-2016-2872 | Medium | 5.3 | 2016-07-02 | Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to re… |
CVE-2016-5307 | Medium | 4.3 | 2016-06-30 | Directory traversal vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to read arbitrary files… |
CVE-2016-1434 | Medium | 6.5 | 2016-06-23 | The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an inva… |
CVE-2016-1192 | Medium | 4.3 | 2016-06-19 | Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspe… |
CVE-2016-1191 | Medium | 5.3 | 2016-06-19 | Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified ve… |
CVE-2016-4815 | High | 7.5 | 2016-06-19 | Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows r… |
CVE-2016-4814 | High | 7.5 | 2016-06-19 | Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows re… |
CVE-2016-1223 | Medium | 5.3 | 2016-06-19 | Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote… |
CVE-2016-4532 | Critical | 9.1 | 2016-06-09 | Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbi… |
CVE-2015-8799 | High | 7.6 | 2016-06-08 | Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded S… |
CVE-2015-8798 | High | 8.0 | 2016-06-08 | Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded S… |
CVE-2016-1212 | Low | 2.7 | 2016-06-05 | Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrar… |
CVE-2014-9767 | Medium | 4.3 | 2016-05-22 | Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13… |
CVE-2016-1671 | High | 8.1 | 2016-05-14 | Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks… |
CVE-2016-1593 | High | 7.2 | 2016-04-22 | Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to uploa… |
CVE-2016-3972 | Low | 2.7 | 2016-04-18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (… |
CVE-2016-4004 | Medium | 4.9 | 2016-04-12 | Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary files via a… |
CVE-2015-5313 | Low | 2.5 | 2016-04-11 | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Con… |
CVE-2016-0784 | Medium | 6.5 | 2016-04-11 | Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrat… |
CVE-2016-0709 | High | 7.2 | 2016-04-11 | Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administ… |
CVE-2016-3976 | High | 7.5 | 2016-04-07 | Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the… |
CVE-2016-2097 | Medium | 5.3 | 2016-04-07 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by le… |
CVE-2016-2289 | High | 7.5 | 2016-04-01 | Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashe… |
CVE-2015-5345 | Medium | 5.3 | 2016-02-25 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering s… |
CVE-2015-5174 | Medium | 4.3 | 2016-02-25 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated… |
CVE-2013-7448 | High | 7.5 | 2016-02-23 | Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get. |
CVE-2016-2389 | High | 7.5 | 2016-02-16 | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4… |
CVE-2016-0752 | High | 7.5 | 2016-02-16 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0… |
CVE-2016-1525 | High | 8.6 | 2016-02-13 | Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read ar… |
CVE-2016-1145 | High | 7.5 | 2016-01-30 | Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote… |
CVE-2015-8794 | Medium | 6.5 | 2016-01-29 | Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users… |
CVE-2015-8770 | High | 7.5 | 2016-01-29 | Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows re… |
CVE-2015-6833 | High | 7.5 | 2016-01-19 | Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to… |
CVE-2015-4988 | High | 8.6 | 2016-01-18 | Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before… |
CVE-2016-0855 | High | 7.5 | 2016-01-15 | Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors. |
CVE-2016-1231 | Medium | 5.9 | 2016-01-12 | Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary file… |
CVE-2015-5471 | Medium | 5.3 | 2016-01-12 | Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary f… |
CVE-2015-4703 | Medium | 5.3 | 2016-01-12 | Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary file… |
CVE-2015-4694 | High | 8.6 | 2016-01-08 | Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via… |
CVE-2015-2007 | Medium | 5.0 | 2016-01-03 | Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafte… |
CVE-2015-2875 | High | 7.5 | 2015-12-31 | Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL device… |
CVE-2015-7250 | High | 7.5 | 2015-12-30 | Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitra… |
CVE-2015-7907 | High | 8.6 | 2015-12-21 | Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote at… |
CVE-2015-8565 | | 2015-12-16 | Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors. |