Filtered by CWE-23
Filtered by vendor Subscriptions
Total 399 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-25944 1 Dell 1 Openmanage Enterprise 2025-02-04 5.7 Medium
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, to gain unauthorized access to the files stored on the server filesystem, with the privileges of the running web application.
CVE-2024-46664 1 Fortinet 1 Fortirecorder 2025-01-31 5.2 Medium
A relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to read files from the underlying filesystem via crafted HTTP or HTTPs requests.
CVE-2024-54154 1 Jetbrains 1 Youtrack 2025-01-31 8 High
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
CVE-2023-2356 1 Lfprojects 1 Mlflow 2025-01-30 7.5 High
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
CVE-2024-32116 1 Fortinet 3 Fortianalyzer, Fortianalyzer Big Data, Fortimanager 2025-01-22 4.8 Medium
Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
CVE-2024-35274 1 Fortinet 3 Fortianalyzer, Fortianalyzer Big Data, Fortimanager 2025-01-17 2.2 Low
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read write administrative privileges to create non-arbitrary files on a chosen directory via crafted CLI requests.
CVE-2024-0550 1 Mintplexlabs 1 Anythingllm 2025-01-10 6.5 Medium
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.
CVE-2024-45816 2 Linuxfoundation, Redhat 2 Backstage, Rhdh 2025-01-03 6.5 Medium
Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-35359 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2025-01-01 7.8 High
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-33144 1 Microsoft 1 Visual Studio Code 2025-01-01 6.6 Medium
Visual Studio Code Spoofing Vulnerability
CVE-2023-23391 1 Microsoft 1 Office 2025-01-01 5.5 Medium
Office for Android Spoofing Vulnerability
CVE-2024-43454 1 Microsoft 10 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 and 7 more 2025-01-01 7.1 High
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38258 1 Microsoft 10 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 and 7 more 2025-01-01 6.5 Medium
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
CVE-2023-42791 1 Fortinet 1 Fortimanager 2024-12-17 8.6 High
A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVE-2024-36362 1 Jetbrains 1 Teamcity 2024-12-16 6.5 Medium
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
CVE-2024-12482 1 Cjbi 1 Wetech-cms 2024-12-13 4.3 Medium
A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cms-master\wetech-basic-common\src\main\java\tech\wetech\basic\util\BackupFileUtil.java of the component Database Backup Handler. The manipulation of the argument name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-11067 1 Dlink 2 Dsl6740c, Dsl6740c Firmware 2024-11-24 7.5 High
The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password.
CVE-2024-37138 1 Dell 1 Data Domain Operating System 2024-11-21 4.1 Medium
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the managed system.
CVE-2024-24942 1 Jetbrains 1 Teamcity 2024-11-21 5.3 Medium
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
CVE-2024-22415 1 Jupyter 1 Language Server Protocol Integration 2024-11-21 7.3 High
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.