CWE-23 · Relative Path Traversal (page 4)
Page 4 of 6 — CVEs classified under CWE-23, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35274 | Low | 2.3 | 2024-11-12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortin… |
CVE-2024-32116 | Medium | 5.1 | 2024-11-12 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 th… |
CVE-2024-11067 | High | 7.5 | 2024-11-11 | The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-50453 | High | 7.5 | 2024-10-28 | Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elemento… |
CVE-2024-10200 | High | 7.5 | 2024-10-21 | Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to… |
CVE-2024-49253 | High | 8.6 | 2024-10-16 | Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: fro… |
CVE-2024-47637 | High | 8.8 | 2024-10-16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from… |
CVE-2024-9983 | High | 7.5 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabil… |
CVE-2024-45731 | High | 8.0 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could wri… |
CVE-2024-9923 | Medium | 4.9 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitr… |
CVE-2024-9922 | High | 7.5 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabilit… |
CVE-2024-6985 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any f… |
CVE-2024-43614 | Medium | 5.5 | 2024-10-08 | Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally. |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47769 | High | 7.5 | 2024-10-04 | IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is id… |
CVE-2024-20449 | High | 8.8 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code o… |
CVE-2024-9405 | Medium | 5.3 | 2024-10-01 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attac… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-43454 | High | 7.1 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-38258 | Medium | 6.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Information Disclosure Vulnerability |
CVE-2024-43399 | High | 8.0 | 2024-08-19 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Befor… |
CVE-2024-7693 | High | 7.5 | 2024-08-12 | Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to rea… |
CVE-2024-6433 | High | 7.5 | 2024-07-10 | The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted p… |
CVE-2024-3122 | Medium | 4.9 | 2024-07-01 | CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privile… |
CVE-2024-5547 | High | 7.5 | 2024-06-27 | A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vuln… |
CVE-2024-37138 | Medium | 4.1 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high p… |
CVE-2024-3497 | High | 8.8 | 2024-06-14 | Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the af… |
CVE-2024-2461 | | 2024-06-11 | If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible | |
CVE-2024-4330 | Low | 3.3 | 2024-05-30 | A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to imprope… |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-35186 | High | 8.8 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A speci… |
CVE-2023-3941 | Critical | 10.0 | 2024-05-21 | Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affec… |
CVE-2023-3940 | High | 7.5 | 2024-05-21 | Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM… |
CVE-2024-33615 | High | 8.8 | 2024-05-15 | A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the ser… |
CVE-2024-30010 | High | 8.8 | 2024-05-14 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2024-34712 | Medium | 6.5 | 2024-05-14 | Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encod… |
CVE-2024-0549 | High | 8.1 | 2024-04-16 | mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and f… |
CVE-2024-32005 | High | 8.2 | 2024-04-12 | NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under th… |
CVE-2024-3025 | Critical | 9.9 | 2024-04-10 | mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. At… |
CVE-2024-0335 | High | 7.5 | 2024-04-03 | ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g… |
CVE-2024-20352 | Medium | 4.9 | 2024-04-03 | A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attac… |
CVE-2024-20310 | Medium | 6.1 | 2024-04-03 | A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remo… |
CVE-2024-25944 | Medium | 5.7 | 2024-03-29 | Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulner… |
CVE-2024-2053 | High | 7.5 | 2024-03-21 | The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-24578 | Critical | 10.0 | 2024-03-18 | RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a u… |
CVE-2024-27770 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal |
CVE-2024-22398 | Medium | 4.9 | 2024-03-14 | An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attack… |
CVE-2023-6825 | Critical | 9.9 | 2024-03-13 | The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version)… |
CVE-2024-2318 | Medium | 4.3 | 2024-03-08 | A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-0550 | Medium | 6.5 | 2024-02-28 | A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API… |
CVE-2023-42791 | High | 8.8 | 2024-02-20 | A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2… |
CVE-2024-22226 | Low | 3.3 | 2024-02-12 | Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploi… |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2021-22281 | Medium | 6.3 | 2024-02-02 | : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: fro… |
CVE-2024-22096 | Medium | 6.5 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific com… |
CVE-2024-22421 | High | 7.6 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who cli… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2023-49801 | Medium | 4.2 | 2024-01-12 | Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_ban… |
CVE-2023-31036 | High | 7.5 | 2024-01-12 | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-contr… |
CVE-2023-50255 | Critical | 9.3 | 2023-12-27 | Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be… |
CVE-2023-6722 | High | 7.5 | 2023-12-13 | A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of… |
CVE-2023-6307 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-42783 | High | 7.5 | 2023-11-14 | A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 al… |
CVE-2023-47613 | Medium | 4.4 | 2023-11-09 | A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, T… |
CVE-2023-46119 | High | 7.5 | 2023-10-25 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without exte… |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-3701 | Critical | 9.9 | 2023-10-04 | Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged use… |
CVE-2023-3512 | High | 7.5 | 2023-10-04 | Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker… |
CVE-2023-42456 | Low | 3.3 | 2023-09-21 | Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authen… |
CVE-2023-4760 | High | 7.6 | 2023-09-21 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reas… |
CVE-2023-4914 | High | 7.5 | 2023-09-12 | Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1. |
CVE-2023-4897 | Critical | 9.8 | 2023-09-11 | Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-38185 | High | 8.8 | 2023-08-08 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-35359 | High | 7.8 | 2023-08-08 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-34394 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM… |
CVE-2023-2913 | High | 7.5 | 2023-07-18 | An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disa… |
CVE-2023-34117 | Low | 3.3 | 2023-07-11 | Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access. |
CVE-2023-37288 | Medium | 6.5 | 2023-07-10 | SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerabili… |
CVE-2023-33144 | Medium | 6.6 | 2023-06-14 | Visual Studio Code Spoofing Vulnerability |
CVE-2022-42474 | Medium | 6.5 | 2023-06-13 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy ver… |
CVE-2023-27993 | Medium | 6.0 | 2023-05-03 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the un… |
CVE-2023-2356 | High | 7.5 | 2023-04-28 | Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-30630 | High | 7.1 | 2023-04-13 | Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible… |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2023-29189 | Medium | 5.4 | 2023-04-11 | SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to… |
CVE-2023-20066 | Medium | 6.5 | 2023-03-23 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that… |
CVE-2023-23391 | Medium | 5.5 | 2023-03-14 | Office for Android Spoofing Vulnerability |
CVE-2022-42476 | High | 8.2 | 2023-03-07 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2… |
CVE-2022-3162 | Medium | 6.5 | 2023-03-01 | Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group witho… |
CVE-2023-1112 | Medium | 4.7 | 2023-03-01 | A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown… |
CVE-2023-0511 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java… |
CVE-2023-0339 | Critical | 9.1 | 2023-02-28 | Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Po… |
CVE-2023-1045 | Low | 3.8 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accesso… |
CVE-2023-1044 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/i… |
CVE-2023-1043 | Medium | 4.3 | 2023-02-26 | A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulatio… |