Filtered by CWE-22
Filtered by vendor Subscriptions
Total 9220 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6753 2 Lfprojects, Microsoft 2 Mlflow, Windows 2024-11-21 8.8 High
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
CVE-2023-6577 1 Byzoro 2 Patrolflow-am-2530pro, Patrolflow-am-2530pro Firmware 2024-11-21 4.3 Medium
A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file /log/mailsendview.php. The manipulation of the argument file with the input /boot/phpConfig/tb_admin.txt leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-6562 1 Kakadusoftware 1 Kakadu Sdk 2024-11-21 7.5 High
JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.
CVE-2023-6458 1 Mattermost 1 Mattermost Server 2024-11-21 7.1 High
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.
CVE-2023-6352 1 Aquaforest 1 Tiff Server 2024-11-21 5.3 Medium
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.
CVE-2023-6307 1 Jeecg 1 Jimureport 2024-11-21 6.3 Medium
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246133 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-6265 1 Draytek 2 Vigor2960, Vigor2960 Firmware 2024-11-21 6.5 Medium
** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.
CVE-2023-6252 1 Hyphensolutions 1 Chameleon Power 2024-11-21 7.5 High
Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files located on the server and gain access to sensitive information such as configuration files.
CVE-2023-6222 1 Quttera 1 Quttera Web Malware Scanner 2024-11-21 7.2 High
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
CVE-2023-6032 1 Schneider-electric 4 Galaxy Vl, Galaxy Vl Firmware, Galaxy Vs and 1 more 2024-11-21 5.3 Medium
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and file download when an attacker navigates to the Network Management Card via HTTPS.
CVE-2023-6026 1 Elijaa 1 Phpmemcachedadmin 2024-11-21 9.8 Critical
A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input.
CVE-2023-6023 1 Vertaai 1 Modeldb 2024-11-21 7.5 High
An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.
CVE-2023-6015 1 Lfprojects 1 Mlflow 2024-11-21 7.5 High
MLflow allowed arbitrary files to be PUT onto the server.
CVE-2023-5991 1 Motopress 1 Hotel Booking Lite 2024-11-21 9.8 Critical
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
CVE-2023-5885 1 Franklinfueling 2 Colibri, Colibri Firmware 2024-11-21 6.5 Medium
The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users.
CVE-2023-5607 1 Trellix 1 Application And Change Control 2024-11-21 8.4 High
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
CVE-2023-5588 1 Kpherox 1 Pleroma 2024-11-21 2.6 Low
A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.
CVE-2023-5327 1 Sato 2 Cl4nx-j Plus, Cl4nx-j Plus Firmware 2024-11-21 3.5 Low
A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /rest/dir/. The manipulation of the argument full leads to path traversal. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241028.
CVE-2023-5257 2 Microsoft, Whitehsbg 2 Windows, Jndiexploit 2024-11-21 3.5 Low
A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability.
CVE-2023-5142 1 H3c 30 Er2100n, Er2100n Firmware, Er2200g2 and 27 more 2024-11-21 3.7 Low
A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.