CWE-36 · Absolute Path Traversal (page 2)
Page 2 of 2 — CVEs classified under CWE-36, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45290 | High | 7.7 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from… |
CVE-2024-8497 | High | 7.5 | 2024-09-25 | Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator… |
CVE-2024-8778 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arb… |
CVE-2024-7323 | Medium | 6.5 | 2024-08-02 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with… |
CVE-2024-28806 | High | 7.5 | 2024-07-29 | An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Remote unauthenticated attackers can upload files at an arbitrary path. |
CVE-2024-20401 | Critical | 9.8 | 2024-07-17 | A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwri… |
CVE-2024-6250 | High | 7.5 | 2024-06-27 | An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_… |
CVE-2024-33620 | High | 8.6 | 2024-06-18 | Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents includ… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |
CVE-2023-41830 | Medium | 6.5 | 2024-05-03 | An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorizatio… |
CVE-2024-29053 | High | 8.8 | 2024-04-09 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2024-21323 | High | 8.8 | 2024-04-09 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2023-50955 | Low | 2.4 | 2024-02-21 | IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid… |
CVE-2023-5390 | Medium | 5.3 | 2024-01-31 | An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. T… |
CVE-2023-30970 | Medium | 6.5 | 2024-01-29 | Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file s… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-36786 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-5022 | Medium | 5.5 | 2023-09-17 | A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /inc… |
CVE-2023-40597 | High | 7.8 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located… |
CVE-2023-4172 | Medium | 4.3 | 2023-08-05 | A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some… |
CVE-2023-3765 | Critical | 10.0 | 2023-07-19 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. |
CVE-2023-34135 | Medium | 6.5 | 2023-07-13 | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via… |
CVE-2023-32054 | High | 7.3 | 2023-07-11 | Volume Shadow Copy Elevation of Privilege Vulnerability |
CVE-2023-2765 | Medium | 4.3 | 2023-05-17 | A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/F… |
CVE-2023-2101 | Medium | 4.3 | 2023-04-15 | A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of t… |
CVE-2023-1176 | Low | 3.3 | 2023-03-24 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. |
CVE-2022-20958 | High | 8.3 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a se… |
CVE-2022-20791 | Medium | 6.5 | 2022-07-06 | A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management E… |
CVE-2022-24877 | Critical | 9.9 | 2022-05-06 | Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` all… |
CVE-2022-1554 | High | 7.5 | 2022-05-03 | Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52. |
CVE-2021-34711 | Medium | 5.5 | 2021-10-06 | A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vul… |
CVE-2021-1618 | Medium | 6.5 | 2021-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a… |
CVE-2021-1617 | Medium | 6.5 | 2021-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a… |
CVE-2021-21586 | High | 8.1 | 2021-07-15 | Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulne… |
CVE-2021-32507 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path p… |
CVE-2021-32506 | Medium | 6.5 | 2021-07-07 | Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path param… |
CVE-2021-30173 | Medium | 6.5 | 2021-05-07 | Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter an… |
CVE-2021-1297 | High | 7.5 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unau… |
CVE-2021-1296 | High | 7.5 | 2021-02-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unau… |
CVE-2018-20250 | High | 7.8 | 2019-02-05 | In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When… |
CVE-2017-7929 | High | 7.1 | 2017-05-06 | An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, wh… |