CWE-23 · Relative Path Traversal (page 5)
Page 5 of 5 — CVEs classified under CWE-23, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25150 | High | 7.6 | 2022-04-14 | A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows… |
CVE-2022-22279 | Medium | 4.9 | 2022-04-13 | A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile… |
CVE-2022-20755 | Critical | 9.0 | 2022-04-06 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20754 | Critical | 9.0 | 2022-04-06 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-23732 | High | 8.8 | 2022-04-05 | A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentiall… |
CVE-2021-32949 | High | 7.5 | 2022-04-01 | An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the dire… |
CVE-2020-25176 | Critical | 9.1 | 2022-03-18 | Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sy… |
CVE-2022-21808 | High | 8.8 | 2022-03-11 | Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.0… |
CVE-2022-21177 | High | 8.1 | 2022-03-11 | There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10… |
CVE-2021-37196 | Medium | 6.5 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-41242 | High | 8.1 | 2021-12-10 | OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filen… |
CVE-2021-20040 | High | 7.5 | 2021-12-08 | A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody… |
CVE-2021-43176 | High | 8.8 | 2021-12-07 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and… |
CVE-2021-43555 | High | 7.3 | 2021-11-19 | mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path t… |
CVE-2021-22870 | Medium | 6.5 | 2021-11-10 | A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit… |
CVE-2021-34594 | Medium | 6.5 | 2021-11-04 | TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path trav… |
CVE-2021-41178 | High | 8.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker… |
CVE-2021-41127 | High | 7.3 | 2021-10-21 | Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functional… |
CVE-2020-27304 | Critical | 9.8 | 2021-10-21 | The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mec… |
CVE-2021-41152 | High | 7.7 | 2021-10-18 | OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by… |
CVE-2021-40870 | Critical | 9.8 | 2021-09-13 | An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unaut… |
CVE-2021-32825 | Low | 2.7 | 2021-08-16 | bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 there is a "zipslip" vu… |
CVE-2021-22674 | Medium | 6.5 | 2021-08-10 | The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebA… |
CVE-2021-32954 | Medium | 6.5 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the… |
CVE-2021-24035 | Critical | 9.1 | 2021-06-11 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed… |
CVE-2021-28798 | High | 8.8 | 2021-05-21 | A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to mo… |
CVE-2021-29488 | Medium | 4.3 | 2021-05-07 | SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downlo… |
CVE-2021-29101 | High | 7.5 | 2021-05-05 | ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to… |
CVE-2021-29100 | High | 7.8 | 2021-05-05 | A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted… |
CVE-2020-4039 | High | 8.6 | 2021-04-30 | SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient inp… |
CVE-2020-7861 | High | 8.4 | 2021-04-22 | AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a management PC to a client… |
CVE-2020-8570 | Critical | 9.1 | 2021-01-21 | Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple fil… |
CVE-2020-17518 | High | 7.5 | 2021-01-05 | Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously… |
CVE-2019-19287 | Medium | 6.5 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow attackers to traverse through the file system of the server base… |
CVE-2020-8271 | Critical | 9.8 | 2020-11-16 | Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2020-25172 | Critical | 9.8 | 2020-11-06 | A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. |
CVE-2020-8254 | High | 8.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vul… |
CVE-2019-17640 | Critical | 9.8 | 2020-10-15 | In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4… |
CVE-2020-3597 | Medium | 5.4 | 2020-10-08 | A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated, remote attacker to perform a directory… |
CVE-2020-1904 | Medium | 5.5 | 2020-10-06 | A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
CVE-2020-7377 | High | 8.1 | 2020-08-24 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar meth… |
CVE-2020-7376 | High | 7.1 | 2020-08-24 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can… |
CVE-2020-5410 | High | 7.5 | 2020-06-02 | Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configu… |
CVE-2020-12026 | High | 8.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to… |
CVE-2020-12010 | High | 7.1 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user t… |
CVE-2020-12006 | Critical | 9.8 | 2020-05-08 | Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to… |
CVE-2020-10631 | Critical | 9.8 | 2020-04-09 | An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control. |
CVE-2020-10619 | Critical | 9.1 | 2020-04-09 | An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. |
CVE-2020-7008 | High | 7.5 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an… |
CVE-2020-5284 | Medium | 4.4 | 2020-03-30 | Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). T… |
CVE-2020-5280 | High | 7.6 | 2020-03-25 | http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.stat… |
CVE-2020-8865 | Medium | 6.3 | 2020-03-23 | This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is re… |
CVE-2020-5405 | Medium | 6.5 | 2020-03-05 | Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configu… |
CVE-2020-5237 | High | 8.8 | 2020-02-05 | Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files o… |
CVE-2018-12476 | Medium | 4.3 | 2020-01-27 | Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a r… |
CVE-2019-18338 | High | 7.7 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal vuln… |
CVE-2019-13944 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100… |
CVE-2019-3976 | High | 8.8 | 2019-10-29 | RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name fie… |
CVE-2019-0074 | Medium | 5.5 | 2019-10-09 | A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE)… |
CVE-2019-13408 | High | 7.5 | 2019-08-29 | A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportS… |
CVE-2019-11826 | High | 8.0 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary… |
CVE-2019-11822 | Medium | 4.3 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upl… |
CVE-2019-3943 | High | 8.1 | 2019-04-10 | MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote d… |
CVE-2018-13299 | Medium | 4.3 | 2019-04-01 | Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files… |
CVE-2018-18990 | Medium | 5.3 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerab… |
CVE-2018-12473 | Low | 3.1 | 2018-10-02 | A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. O… |
CVE-2018-14795 | High | 8.8 | 2018-08-21 | DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files. |
CVE-2018-10615 | High | 8.1 | 2018-06-04 | Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform. |
CVE-2017-9664 | Critical | 9.8 | 2018-05-24 | In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal… |
CVE-2018-5448 | Medium | 4.8 | 2018-05-04 | Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the… |
CVE-2017-0918 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. |
CVE-2017-13996 | High | 8.8 | 2017-10-05 | A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files tha… |
CVE-2012-6069 | Critical | 10.0 | 2013-01-21 | The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside… |
CVE-2012-5972 | | 2013-01-17 | Directory traversal vulnerability in the web server in SpecView 2.5 build 853 and earlier allows remote attackers to read arbitrary files via a ... (dot dot do… |