CWE-73 · External Control of File Name or Path (page 8)
Page 8 of 8 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24900 | Critical | 9.9 | 2022-04-29 | Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to… |
CVE-2022-20789 | Medium | 4.9 | 2022-04-21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-0246 | Medium | 4.9 | 2022-04-11 | The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import p… |
CVE-2022-0593 | Medium | 6.5 | 2022-03-14 | The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugi… |
CVE-2021-24966 | Medium | 4.9 | 2022-03-14 | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files… |
CVE-2021-3845 | High | 7.5 | 2022-01-04 | ws-scrcpy is vulnerable to External Control of File Name or Path |
CVE-2021-34761 | Medium | 4.4 | 2021-10-27 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system f… |
CVE-2021-38477 | Critical | 9.8 | 2021-10-22 | There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipulation and/or the de… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-1306 | Medium | 4.4 | 2021-05-22 | A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructu… |
CVE-2021-22539 | High | 8.2 | 2021-04-16 | An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl… |
CVE-2021-27250 | Medium | 6.5 | 2021-04-14 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access poi… |
CVE-2021-21343 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at… |
CVE-2020-25161 | High | 8.8 | 2021-02-23 | The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2020-26078 | Medium | 6.5 | 2020-11-18 | A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected sy… |
CVE-2020-15264 | High | 8.0 | 2020-10-20 | The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory… |
CVE-2020-6105 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can… |
CVE-2020-8553 | Medium | 5.9 | 2020-07-29 | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to ov… |
CVE-2019-3681 | High | 7.5 | 2020-06-29 | A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Developme… |
CVE-2020-5297 | Low | 3.4 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp… |
CVE-2020-5296 | Medium | 6.2 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local… |
CVE-2020-2009 | High | 7.2 | 2020-05-13 | An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a req… |
CVE-2020-2008 | High | 7.2 | 2020-05-13 | An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with ro… |
CVE-2020-2003 | Medium | 6.5 | 2020-05-13 | An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affect… |
CVE-2020-1631 | High | 8.8 | 2020-05-04 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Ze… |
CVE-2020-1984 | High | 7.8 | 2020-04-08 | Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root… |
CVE-2019-14905 | Medium | 5.6 | 2020-03-31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy… |
CVE-2020-9752 | Critical | 9.8 | 2020-03-23 | Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe. |
CVE-2018-17246 | Critical | 9.8 | 2018-12-20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could… |
CVE-2018-14820 | High | 7.5 | 2018-10-23 | Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbit… |
CVE-2018-7495 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2014-2375 | | 2014-09-15 | Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain… |