Filtered by CWE-73
Filtered by vendor Subscriptions
Total 425 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2013-2068 1 Redhat 2 Cloudforms, Cloudforms Management Engine 2025-04-11 N/A
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVE-2010-1000 1 Kde 1 Kde Sc 2025-04-11 N/A
Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
CVE-2011-1586 2 Kde, Redhat 2 Kde Sc, Enterprise Linux 2025-04-11 N/A
Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.
CVE-2010-1511 1 Kde 2 Kde Sc, Kget 2025-04-11 N/A
KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.
CVE-2024-51961 1 Esri 1 Arcgis Server 2025-04-10 7.5 High
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
CVE-2022-45213 1 Perfsonar 1 Perfsonar 2025-04-10 5.3 Medium
perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL.
CVE-2022-34669 2 Microsoft, Nvidia 3 Windows, Cloud Gaming, Virtual Gpu 2025-04-10 8.8 High
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVE-2024-38040 1 Esri 1 Portal For Arcgis 2025-04-10 7.5 High
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.
CVE-2025-25761 1 Hkcms 1 Hkcms 2025-04-09 7.2 High
HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.
CVE-2022-43513 1 Siemens 1 Automation License Manager 2025-04-09 8.2 High
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.
CVE-2024-20366 1 Cisco 1 Network Services Orchestrator 2025-03-25 7.8 High
A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled search path is used to locate executable files. An attacker could exploit this vulnerability by configuring the application in a way that causes a malicious file to be executed. A successful exploit could allow the attacker to execute arbitrary code on an affected device as the root user. To exploit this vulnerability, the attacker would need valid credentials on an affected device.
CVE-2022-2431 1 W3eden 1 Download Manager 2025-03-21 8.1 High
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.
CVE-2023-1105 1 Flatpress 1 Flatpress 2025-03-11 8.1 High
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
CVE-2023-1070 1 Teampass 1 Teampass 2025-03-10 7.1 High
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
CVE-2024-2917 1 Campcodes 1 House Rental Management System 2025-02-20 5.4 Medium
A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257983.
CVE-2024-4818 1 Campcodes 1 Online Laundry Management System 2025-02-20 5.3 Medium
A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263939.
CVE-2024-1603 1 Paddlepaddle 2 Paddle, Paddlepaddle 2025-02-13 7.5 High
paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.
CVE-2023-0003 2 Fedoraproject, Paloaltonetworks 2 Fedora, Cortex Xsoar 2025-02-13 6.5 Medium
A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
CVE-2023-32615 1 Openautomationsoftware 1 Oas Platform 2025-02-13 6.5 Medium
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2023-2554 1 Bumsys Project 1 Bumsys 2025-02-12 7.2 High
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.