CWE-23 · Relative Path Traversal (page 4)
Page 4 of 5 — CVEs classified under CWE-23, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32005 | High | 8.2 | 2024-04-12 | NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under th… |
CVE-2024-3025 | Critical | 9.9 | 2024-04-10 | mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. At… |
CVE-2024-0335 | High | 7.5 | 2024-04-03 | ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g… |
CVE-2024-20352 | Medium | 4.9 | 2024-04-03 | A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attac… |
CVE-2024-20310 | Medium | 6.1 | 2024-04-03 | A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remo… |
CVE-2024-25944 | Medium | 5.7 | 2024-03-29 | Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulner… |
CVE-2024-2053 | High | 7.5 | 2024-03-21 | The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-24578 | Critical | 10.0 | 2024-03-18 | RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a u… |
CVE-2024-27770 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal |
CVE-2024-22398 | Medium | 4.9 | 2024-03-14 | An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attack… |
CVE-2023-6825 | Critical | 9.9 | 2024-03-13 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version)… |
CVE-2024-2318 | Medium | 4.3 | 2024-03-08 | A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-0550 | Medium | 6.5 | 2024-02-28 | A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API… |
CVE-2023-42791 | High | 8.8 | 2024-02-20 | A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2… |
CVE-2024-22226 | Low | 3.3 | 2024-02-12 | Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploi… |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2021-22281 | Medium | 6.3 | 2024-02-02 | : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: fro… |
CVE-2024-22096 | Medium | 6.5 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific com… |
CVE-2024-22421 | High | 7.6 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who cli… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2023-49801 | Medium | 4.2 | 2024-01-12 | Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_ban… |
CVE-2023-31036 | High | 7.5 | 2024-01-12 | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-contr… |
CVE-2023-50255 | Critical | 9.3 | 2023-12-27 | Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be… |
CVE-2023-6722 | High | 7.5 | 2023-12-13 | A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of… |
CVE-2023-6307 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-42783 | High | 7.5 | 2023-11-14 | A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 al… |
CVE-2023-47613 | Medium | 4.4 | 2023-11-09 | A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, T… |
CVE-2023-46119 | High | 7.5 | 2023-10-25 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without exte… |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-3701 | Critical | 9.9 | 2023-10-04 | Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged use… |
CVE-2023-3512 | High | 7.5 | 2023-10-04 | Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker… |
CVE-2023-42456 | Low | 3.3 | 2023-09-21 | Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authen… |
CVE-2023-4760 | High | 7.6 | 2023-09-21 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reas… |
CVE-2023-4914 | High | 7.5 | 2023-09-12 | Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1. |
CVE-2023-4897 | Critical | 9.8 | 2023-09-11 | Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-38185 | High | 8.8 | 2023-08-08 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-35359 | High | 7.8 | 2023-08-08 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-34394 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM… |
CVE-2023-2913 | High | 7.5 | 2023-07-18 | An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disa… |
CVE-2023-34117 | Low | 3.3 | 2023-07-11 | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
CVE-2023-37288 | Medium | 6.5 | 2023-07-10 | SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerabili… |
CVE-2023-33144 | Medium | 6.6 | 2023-06-14 | Visual Studio Code Spoofing Vulnerability |
CVE-2022-42474 | Medium | 6.5 | 2023-06-13 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy ver… |
CVE-2023-27993 | Medium | 6.0 | 2023-05-03 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the un… |
CVE-2023-2356 | High | 7.5 | 2023-04-28 | Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-30630 | High | 7.1 | 2023-04-13 | Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible… |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2023-29189 | Medium | 5.4 | 2023-04-11 | SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to… |
CVE-2023-20066 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that… |
CVE-2023-23391 | Medium | 5.5 | 2023-03-14 | Office for Android Spoofing Vulnerability |
CVE-2022-42476 | High | 8.2 | 2023-03-07 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2… |
CVE-2022-3162 | Medium | 6.5 | 2023-03-01 | Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group witho… |
CVE-2023-1112 | Medium | 4.7 | 2023-03-01 | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown… |
CVE-2023-0511 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java… |
CVE-2023-0339 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Po… |
CVE-2023-1045 | Low | 3.8 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accesso… |
CVE-2023-1044 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/i… |
CVE-2023-1043 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulatio… |
CVE-2023-23784 | Medium | 5.7 | 2023-02-16 | A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to… |
CVE-2023-23778 | Medium | 4.9 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authent… |
CVE-2022-41335 | High | 8.8 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2… |
CVE-2022-30300 | Medium | 6.5 | 2023-02-16 | A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to… |
CVE-2022-30299 | Medium | 5.3 | 2023-02-16 | A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions… |
CVE-2023-23379 | High | 7.8 | 2023-02-14 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2023-0745 | Medium | 6.7 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoin… |
CVE-2022-29844 | Medium | 6.7 | 2023-01-26 | A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write ar… |
CVE-2023-20040 | Medium | 5.5 | 2023-01-20 | A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service… |
CVE-2022-38205 | High | 8.6 | 2022-12-29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker… |
CVE-2022-38202 | High | 7.5 | 2022-12-28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker t… |
CVE-2022-23854 | High | 7.5 | 2022-12-23 | AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network acces… |
CVE-2022-23531 | Medium | 5.8 | 2022-12-17 | GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted… |
CVE-2022-4123 | Low | 3.3 | 2022-12-08 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to co… |
CVE-2022-42892 | Medium | 5.3 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2021-38399 | High | 7.5 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized fil… |
CVE-2022-39345 | Critical | 9.8 | 2022-10-25 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vuln… |
CVE-2022-22245 | Medium | 4.3 | 2022-10-18 | A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by… |
CVE-2022-33937 | High | 7.1 | 2022-10-12 | Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit… |
CVE-2022-2922 | Medium | 4.9 | 2022-09-30 | Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. |
CVE-2022-28814 | Critical | 9.8 | 2022-09-28 | Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability w… |
CVE-2022-36081 | High | 7.5 | 2022-09-07 | Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discl… |
CVE-2022-34378 | Medium | 5.5 | 2022-09-02 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerability. A low priv… |
CVE-2022-34836 | Medium | 5.9 | 2022-08-24 | Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., fl… |
CVE-2022-1373 | High | 7.2 | 2022-08-17 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files… |
CVE-2021-22650 | High | 7.5 | 2022-07-28 | An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code executio… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-2139 | Medium | 6.5 | 2022-07-22 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. |
CVE-2022-31163 | High | 7.5 | 2022-07-22 | TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as th… |
CVE-2022-20913 | Medium | 4.9 | 2022-07-22 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is du… |
CVE-2022-20862 | Medium | 4.3 | 2022-07-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2022-2106 | Low | 3.8 | 2022-06-27 | Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attac… |
CVE-2022-29097 | Medium | 4.9 | 2022-06-24 | Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unautho… |
CVE-2022-2120 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into a… |
CVE-2022-1661 | High | 7.5 | 2022-06-02 | The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating system files. |
CVE-2021-32964 | Medium | 6.5 | 2022-05-24 | The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to a path traversal attack, which may allow an attacker to read arbitrary files from th… |
CVE-2021-34605 | High | 7.3 | 2022-05-11 | A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a… |
CVE-2022-20790 | Medium | 6.5 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |