CWE-22

Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.

This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in inde

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in i

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation insid

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in ind

SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an exec

Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix Xe

Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker

NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to lau

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConve

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConve

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to

This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relativ

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-lead

Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unau

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a C

An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for

An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on

Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE

Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE P

Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory travers

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP r

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthentic

A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remo

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote

In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D

The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary file

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace e

This affects the package phantom-html-to-pdf before 0.6.1.

In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoo

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Securit

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view

A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0.

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protec

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerabilit

Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a glob

ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=.

Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable pa

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow rem

GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validatio