CWE-73 · External Control of File Name or Path (page 5)
Page 5 of 6 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38029 | High | 7.5 | 2024-10-08 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability |
CVE-2024-38040 | High | 7.5 | 2024-10-04 | There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that co… |
CVE-2024-9275 | Medium | 6.3 | 2024-09-27 | A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/ad… |
CVE-2024-9142 | Critical | 9.8 | 2024-09-25 | External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipul… |
CVE-2024-21545 | High | 8.2 | 2024-09-25 | Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response… |
CVE-2024-7626 | High | 8.1 | 2024-09-11 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due t… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-7744 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web T… |
CVE-2024-7911 | Medium | 6.3 | 2024-08-18 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /sim… |
CVE-2024-38173 | Medium | 6.7 | 2024-08-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-38165 | Medium | 6.5 | 2024-08-13 | Windows Compressed Folder Tampering Vulnerability |
CVE-2024-7497 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /ad… |
CVE-2024-7496 | Medium | 6.3 | 2024-08-06 | A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-6714 | High | 8.8 | 2024-07-23 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. |
CVE-2024-6937 | Low | 2.7 | 2024-07-21 | A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/… |
CVE-2024-6467 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File… |
CVE-2024-39904 | High | 8.8 | 2024-07-11 | VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on t… |
CVE-2024-23317 | Medium | 6.3 | 2024-07-11 | External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arb… |
CVE-2024-37149 | High | 7.2 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-38049 | Medium | 6.6 | 2024-07-09 | Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability |
CVE-2024-39303 | Medium | 4.4 | 2024-07-01 | Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible… |
CVE-2024-5334 | High | 7.5 | 2024-06-27 | A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the '… |
CVE-2024-27175 | Medium | 4.4 | 2024-06-14 | Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the… |
CVE-2024-37295 | High | 7.2 | 2024-06-11 | Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privil… |
CVE-2024-36473 | Medium | 5.3 | 2024-06-10 | Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Servi… |
CVE-2024-25975 | Medium | 6.5 | 2024-05-29 | The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an… |
CVE-2024-28826 | High | 8.8 | 2024-05-29 | Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attacker… |
CVE-2024-20366 | High | 7.8 | 2024-05-15 | A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow a… |
CVE-2024-27945 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upl… |
CVE-2024-27944 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the r… |
CVE-2024-27943 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the ro… |
CVE-2024-25965 | Medium | 6.1 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could pot… |
CVE-2024-4818 | Medium | 5.3 | 2024-05-14 | A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fi… |
CVE-2024-0100 | Medium | 6.5 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulne… |
CVE-2024-0087 | Critical | 9.0 | 2024-05-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file. If this file exists, logs are… |
CVE-2024-33860 | Medium | 6.5 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. Th… |
CVE-2024-33671 | High | 7.7 | 2024-04-26 | An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perf… |
CVE-2024-31492 | High | 8.2 | 2024-04-10 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2024-30265 | High | 7.5 | 2024-04-03 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file… |
CVE-2024-22178 | Medium | 4.9 | 2024-04-03 | A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially… |
CVE-2024-21870 | Medium | 4.9 | 2024-04-03 | A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted… |
CVE-2024-2917 | Medium | 5.4 | 2024-03-26 | A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-1603 | High | 7.5 | 2024-03-23 | paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file. |
CVE-2024-23634 | Medium | 6.0 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exist… |
CVE-2023-47147 | Medium | 5.9 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions. IBM X-Force ID: 270598. |
CVE-2024-26185 | Medium | 6.5 | 2024-03-12 | Windows Compressed Folder Tampering Vulnerability |
CVE-2023-26282 | Medium | 4.2 | 2024-03-05 | IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the sys… |
CVE-2024-2155 | Medium | 4.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-2150 | Medium | 5.3 | 2024-03-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing… |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |
CVE-2020-36772 | Medium | 4.4 | 2024-01-22 | CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitr… |
CVE-2024-0728 | Medium | 4.7 | 2024-01-19 | A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channe… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49738 | High | 7.5 | 2024-01-10 | An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP reque… |
CVE-2023-47862 | Critical | 9.8 | 2024-01-10 | A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP r… |
CVE-2023-47171 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb… |
CVE-2024-20652 | High | 8.1 | 2024-01-09 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2024-0265 | Medium | 6.3 | 2024-01-07 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /i… |
CVE-2023-6569 | High | 8.2 | 2023-12-14 | External Control of File Name or Path in h2oai/h2o-3 |
CVE-2023-36019 | Critical | 9.6 | 2023-12-12 | Microsoft Power Platform Connector Spoofing Vulnerability |
CVE-2023-6618 | Medium | 5.5 | 2023-12-08 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2023-5247 | High | 7.8 | 2023-11-30 | Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a m… |
CVE-2023-40194 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace character… |
CVE-2023-39542 | High | 8.8 | 2023-11-27 | A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files… |
CVE-2023-35985 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dan… |
CVE-2023-34982 | Medium | 5.5 | 2023-11-15 | This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-20114 | Medium | 6.5 | 2023-11-01 | A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to download arbi… |
CVE-2023-43074 | Medium | 5.2 | 2023-10-23 | Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting… |
CVE-2023-36634 | High | 7.1 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through… |
CVE-2023-36764 | High | 8.8 | 2023-09-12 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-4634 | Critical | 9.8 | 2023-09-06 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This i… |
CVE-2023-32615 | Medium | 6.5 | 2023-09-05 | A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted serie… |
CVE-2023-4749 | Medium | 6.3 | 2023-09-04 | A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file ind… |
CVE-2023-20234 | Medium | 4.4 | 2023-08-23 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an a… |
CVE-2023-35384 | Medium | 5.4 | 2023-08-08 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2023-4191 | Medium | 6.3 | 2023-08-06 | A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown funct… |
CVE-2023-3643 | High | 7.3 | 2023-07-12 | A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. Th… |
CVE-2023-35308 | Medium | 6.5 | 2023-07-11 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-3256 | High | 8.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. |
CVE-2023-28603 | High | 7.7 | 2023-06-13 | Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without prop… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-29324 | Medium | 6.5 | 2023-05-09 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-2554 | High | 7.2 | 2023-05-05 | External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0. |
CVE-2023-30943 | Medium | 6.5 | 2023-05-02 | The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user… |
CVE-2023-2152 | Medium | 5.3 | 2023-04-18 | A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is… |
CVE-2021-4332 | Medium | 6.5 | 2023-03-07 | The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plu… |
CVE-2023-1105 | High | 8.1 | 2023-03-01 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1070 | High | 7.1 | 2023-02-27 | External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22. |
CVE-2022-39952 | Critical | 9.8 | 2023-02-16 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7… |
CVE-2023-21566 | High | 7.8 | 2023-02-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-21800 | High | 7.8 | 2023-02-14 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2022-43513 | High | 8.2 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2014-125059 | Medium | 5.0 | 2023-01-07 | A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main… |
CVE-2014-125044 | Medium | 6.3 | 2023-01-05 | A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of… |
CVE-2022-45213 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. |
CVE-2022-34669 | High | 8.8 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or… |