Total
5025 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-1951 | 1 60cyclecms Project | 1 60cyclecms | 2021-08-25 | 6.8 MEDIUM | N/A |
| Multiple directory traversal vulnerabilities in 60cycleCMS allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the DOCUMENT_ROOT parameter to (1) news.php, (2) submitComment.php, and (3) sqlConnect.php. | |||||
| CVE-2020-18878 | 1 Skycaiji | 1 Skycaiji | 2021-08-24 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'. | |||||
| CVE-2020-23069 | 1 Webtareas Project | 1 Webtareas | 2021-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files. | |||||
| CVE-2021-22933 | 1 Pulsesecure | 1 Pulse Connect Secure | 2021-08-24 | 5.5 MEDIUM | 6.5 MEDIUM |
| A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request. | |||||
| CVE-2021-23423 | 1 Bikeshed Project | 1 Bikeshed | 2021-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output. | |||||
| CVE-2021-27402 | 1 Mitel | 1 Micollab | 2021-08-23 | 6.4 MEDIUM | 6.5 MEDIUM |
| The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal. | |||||
| CVE-2021-24363 | 1 10web | 1 Photo Gallery | 2021-08-23 | 4.0 MEDIUM | 4.9 MEDIUM |
| The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector | |||||
| CVE-2021-38511 | 1 Tar Project | 1 Tar | 2021-08-18 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal. | |||||
| CVE-2021-22674 | 1 Advantech | 1 Webaccess\/scada | 2021-08-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1). | |||||
| CVE-2021-31731 | 1 Kitesky | 1 Kitecms | 2021-08-17 | 5.5 MEDIUM | 6.5 MEDIUM |
| A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter. | |||||
| CVE-2020-23172 | 1 Kuba Project | 1 Kuba | 2021-08-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives. | |||||
| CVE-2021-21501 | 1 Apache | 1 Servicecomb | 2021-08-17 | 5.0 MEDIUM | 7.5 HIGH |
| Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0. | |||||
| CVE-2021-38197 | 1 Go-unarr Project | 1 Go-unarr | 2021-08-16 | 10.0 HIGH | 9.8 CRITICAL |
| unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive. | |||||
| CVE-2015-2074 | 1 Sap | 1 Businessobjects Edge | 2021-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681. | |||||
| CVE-2015-2073 | 1 Sap | 1 Businessobjects Edge | 2021-08-13 | 5.0 MEDIUM | 7.5 HIGH |
| The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP Note 2018682. | |||||
| CVE-2021-37367 | 1 Ctparental Project | 1 Ctparental | 2021-08-13 | 4.6 MEDIUM | 7.8 HIGH |
| CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "bl_categories_help.php" is vulnerable to directory traversal, an attacker can create a file that contains scripts and run arbitrary commands. | |||||
| CVE-2021-38136 | 1 Corero | 1 Securewatch Managed Services | 2021-08-13 | 4.0 MEDIUM | 6.5 MEDIUM |
| Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snap_file parameter in the /it-IT/splunkd/__raw/services/get_snapshot HTTP API endpoint. A ‘low privileged’ attacker can read any file on the target host. | |||||
| CVE-2018-1263 | 1 Vmware | 1 Spring Integration Zip | 2021-08-12 | 4.0 MEDIUM | 4.7 MEDIUM |
| Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. | |||||
| CVE-2018-1261 | 1 Vmware | 1 Spring Integration Zip | 2021-08-12 | 4.0 MEDIUM | 4.7 MEDIUM |
| Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. | |||||
| CVE-2016-1223 | 1 Trendmicro | 3 Officescan, Worry-free Business Security, Worry-free Business Security Services | 2021-08-12 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors. | |||||