CWE-22

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

yard before 0.9.20 allows path traversal.

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot d

A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magent

The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of fi

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the ex

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read

IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the sy

A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6

A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remot

The ebook-download plugin before 1.2 for WordPress has directory traversal.

The ad-inserter plugin before 2.4.20 for WordPress has path traversal.

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, l

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .

The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply remove

Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerab

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download

Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher

The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.

In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File D

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https reque

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command,

The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.

The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, w

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.1

The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/downl

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts

Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the sc

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an

In GoogleContactsSyncAdapter, there is a possible path traversal due to improper input sanitization. This could lead to

CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.

Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file

joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of

/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Direct

The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets

The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/u

The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.

The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo

The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of

Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?

Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=