CWE-73 · External Control of File Name or Path (page 7)
Page 7 of 7 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39542 | High | 8.8 | 2023-11-27 | A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files… |
CVE-2023-35985 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dan… |
CVE-2023-34982 | Medium | 5.5 | 2023-11-15 | This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-20114 | Medium | 6.5 | 2023-11-01 | A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to download arbi… |
CVE-2023-43074 | Medium | 5.2 | 2023-10-23 | Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting… |
CVE-2023-36634 | High | 7.1 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through… |
CVE-2023-36764 | High | 8.8 | 2023-09-12 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-4634 | Critical | 9.8 | 2023-09-06 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This i… |
CVE-2023-32615 | Medium | 6.5 | 2023-09-05 | A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted serie… |
CVE-2023-4749 | Medium | 6.3 | 2023-09-04 | A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file ind… |
CVE-2023-20234 | Medium | 4.4 | 2023-08-23 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an a… |
CVE-2023-35384 | Medium | 5.4 | 2023-08-08 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2023-4191 | Medium | 6.3 | 2023-08-06 | A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown funct… |
CVE-2023-3643 | High | 7.3 | 2023-07-12 | A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. Th… |
CVE-2023-35308 | Medium | 6.5 | 2023-07-11 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-3256 | High | 8.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. |
CVE-2023-28603 | High | 7.7 | 2023-06-13 | Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without prop… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-29324 | Medium | 6.5 | 2023-05-09 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
CVE-2023-2554 | High | 7.2 | 2023-05-05 | External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0. |
CVE-2023-30943 | Medium | 6.5 | 2023-05-02 | The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user… |
CVE-2023-2152 | Medium | 5.3 | 2023-04-18 | A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is… |
CVE-2021-4332 | Medium | 6.5 | 2023-03-07 | The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plu… |
CVE-2023-1105 | High | 8.1 | 2023-03-01 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1070 | High | 7.1 | 2023-02-27 | External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22. |
CVE-2022-39952 | Critical | 9.8 | 2023-02-16 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7… |
CVE-2023-21566 | High | 7.8 | 2023-02-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-21800 | High | 7.8 | 2023-02-14 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2022-43513 | High | 8.2 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2014-125059 | Medium | 5.0 | 2023-01-07 | A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main… |
CVE-2014-125044 | Medium | 6.3 | 2023-01-05 | A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of… |
CVE-2022-45213 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. |
CVE-2022-34669 | High | 8.8 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or… |
CVE-2022-31739 | High | 8.8 | 2022-12-22 | When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths th… |
CVE-2022-23536 | Medium | 6.5 | 2022-12-19 | Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where… |
CVE-2022-42893 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42891 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42734 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42733 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42732 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-2431 | High | 8.1 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file ty… |
CVE-2022-2638 | Medium | 6.5 | 2022-08-29 | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This c… |
CVE-2022-32761 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-28710 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP requ… |
CVE-2022-2400 | Medium | 5.3 | 2022-07-18 | External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0. |
CVE-2022-34765 | Medium | 5.5 | 2022-07-13 | A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is writ… |
CVE-2022-24900 | Critical | 9.9 | 2022-04-29 | Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to… |
CVE-2022-20789 | Medium | 4.9 | 2022-04-21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-0246 | Medium | 4.9 | 2022-04-11 | The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import p… |
CVE-2022-0593 | Medium | 6.5 | 2022-03-14 | The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugi… |
CVE-2021-24966 | Medium | 4.9 | 2022-03-14 | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files… |
CVE-2021-3845 | High | 7.5 | 2022-01-04 | ws-scrcpy is vulnerable to External Control of File Name or Path |
CVE-2021-34761 | Medium | 4.4 | 2021-10-27 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system f… |
CVE-2021-38477 | Critical | 9.8 | 2021-10-22 | There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipulation and/or the de… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-1306 | Medium | 4.4 | 2021-05-22 | A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructu… |
CVE-2021-22539 | High | 8.2 | 2021-04-16 | An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl… |
CVE-2021-27250 | Medium | 6.5 | 2021-04-14 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access poi… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2020-25161 | High | 8.8 | 2021-02-23 | The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2020-26078 | Medium | 6.5 | 2020-11-18 | A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected sy… |
CVE-2020-15264 | High | 8.0 | 2020-10-20 | The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory… |
CVE-2020-6105 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can… |
CVE-2020-8553 | Medium | 5.9 | 2020-07-29 | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to ov… |
CVE-2019-3681 | High | 7.5 | 2020-06-29 | A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Developme… |
CVE-2020-5297 | Low | 3.4 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp… |
CVE-2020-5296 | Medium | 6.2 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local… |
CVE-2020-2009 | High | 7.2 | 2020-05-13 | An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a req… |
CVE-2020-2008 | High | 7.2 | 2020-05-13 | An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with ro… |
CVE-2020-2003 | Medium | 6.5 | 2020-05-13 | An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affect… |
CVE-2020-1631 | High | 8.8 | 2020-05-04 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Ze… |
CVE-2020-1984 | High | 7.8 | 2020-04-08 | Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root… |
CVE-2019-14905 | Medium | 5.6 | 2020-03-31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy… |
CVE-2020-9752 | Critical | 9.8 | 2020-03-23 | Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe. |
CVE-2018-17246 | Critical | 9.8 | 2018-12-20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could… |
CVE-2018-14820 | High | 7.5 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbit… |
CVE-2018-7495 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2014-2375 | | 2014-09-15 | Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain… |