Total
5025 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-13195 | 1 Kyocera | 2 Ecosys M5526cdw, Ecosys M5526cdw Firmware | 2020-03-19 | 5.0 MEDIUM | 7.5 HIGH |
| The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user to retrieve arbitrary files, or check if files or folders existed within the file system. | |||||
| CVE-2019-8903 | 1 Totaljs | 1 Total.js | 2020-03-18 | 5.0 MEDIUM | 7.5 HIGH |
| index.js in Total.js Platform before 3.2.3 allows path traversal. | |||||
| CVE-2020-10086 | 1 Gitlab | 1 Gitlab | 2020-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. | |||||
| CVE-2014-10066 | 1 Fancy-server Project | 1 Fancy-server | 2020-03-13 | 5.0 MEDIUM | 7.5 HIGH |
| Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory. | |||||
| CVE-2020-6203 | 1 Sap | 1 Netweaver | 2020-03-12 | 6.4 MEDIUM | 9.1 CRITICAL |
| SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal. | |||||
| CVE-2019-0225 | 1 Apache | 1 Jspwiki | 2020-03-09 | 7.8 HIGH | 7.5 HIGH |
| A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details. | |||||
| CVE-2020-2139 | 1 Jenkins | 1 Cobertura | 2020-03-09 | 8.5 HIGH | 6.5 MEDIUM |
| An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system. | |||||
| CVE-2020-5405 | 1 Vmware | 1 Spring Cloud Config | 2020-03-06 | 4.3 MEDIUM | 6.5 MEDIUM |
| Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. | |||||
| CVE-2019-7007 | 1 Avaya | 1 Aura Conferencing | 2020-03-06 | 5.0 MEDIUM | 8.6 HIGH |
| A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potentially allow an unauthenticated attacker to access files that are outside the restricted directory on the remote server. | |||||
| CVE-2018-7586 | 1 Imagely | 1 Nextgen Gallery | 2020-03-04 | 5.0 MEDIUM | 7.5 HIGH |
| In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. | |||||
| CVE-2020-8810 | 1 Gurux | 1 Device Language Message Specification Director | 2020-03-04 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed. | |||||
| CVE-2017-11500 | 1 Metinfo | 1 Metinfo | 2020-03-03 | 5.0 MEDIUM | 7.5 HIGH |
| A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php. | |||||
| CVE-2014-7951 | 1 Google | 1 Android | 2020-02-25 | 2.1 LOW | 4.6 MEDIUM |
| Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. (dot dot) in the tar archive headers. | |||||
| CVE-2015-6589 | 1 Kaseya | 1 Virtual System Administrator | 2020-02-25 | 6.5 MEDIUM | 8.8 HIGH |
| Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. | |||||
| CVE-2020-9353 | 1 Smartclient | 1 Smartclient | 2020-02-24 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML element in the _transaction parameter. | |||||
| CVE-2020-5187 | 1 Dnnsoftware | 1 Dotnetnuke | 2020-02-24 | 6.5 MEDIUM | 8.8 HIGH |
| DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). | |||||
| CVE-2014-2846 | 1 Westerndigital | 1 Arkeia Virtual Appliance Firmware | 2020-02-24 | 7.5 HIGH | N/A |
| Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin. | |||||
| CVE-2014-0598 | 1 Novell | 1 Open Enterprise Server | 2020-02-24 | 10.0 HIGH | N/A |
| Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors. | |||||
| CVE-2017-5182 | 1 Novell | 1 Open Enterprise Server | 2020-02-24 | 7.8 HIGH | 7.5 HIGH |
| Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077). | |||||
| CVE-2020-8996 | 1 Aishu | 1 Anyshare Cloud | 2020-02-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI. | |||||