CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- codedropz drag and drop multiple file upload - contact form 7Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal4.7 Medium
- kubernetesUnauthorized read of Custom Resources6.5 Medium
- forgerock access management java policy agent, java policy agents +1 moreAM Java Policy Agent path traversal9.1 Critical
- forgerock access management web policy agent, web policy agents +1 moreAM Web Policy Agent path traversal9.1 Critical
- muyucmsMuYuCMS filesdel.html path traversal3.8 Low
- muyucmsMuYuCMS index.php path traversal4.3 Medium
- muyucmsMuYuCMS index.php path traversal4.3 Medium
- fortinet fortiwebA relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all...4.7 Medium
- fortinet fortiwebA relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3...5.6 Medium
- fortinet fortiwebA path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through...5.0 Medium
- fortinet fortiwebA relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6...6.2 Medium
- fortinet fortios, fortiproxy, fortiswitchmanager +2 moreA relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2,...8.6 High
- microsoft defender for iotMicrosoft Defender for IoT Elevation of Privilege Vulnerability7.8 High
- yugabytedb anywhere, yugabyte yugabytedb managed +1 moreArbitrary File Write in High Availability Backup Upload6.7 Medium
- western digital my cloud, westerndigital my cloud dl2100 firmware, my cloud dl4100 firmware +6 more +8 moreWestern Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp6.7 Medium
- cisco network services orchestratorA vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow...5.5 Medium
- esri portal for arcgis, arcgis enterprise +1 morePortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)8.6 High
- esri arcgis serverBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.7.5 High
- aveva intouch access anywhereAVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal...7.5 High
- containers podman, fedoraproject fedora +1 moreBuildah (as part of Podman) vulnerable to Path Traversal3.3 Low
- datadog guarddogArbitrary file write when scanning a specially-crafted local PyPI package5.8 Medium
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...5.3 Medium
- honeywell experion pks, application control environment firmware, c200 firmware +2 more +4 moreHoneywell Experion PKS and ACE Controllers Relative Path Traversal7.5 High
- flipped-aurora gin-vue-adminGin-vue-admin arbitrary file upload vulnerability caused by path traversal9.8 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: Path traversal vulnerability in J-Web4.3 Medium
- dell geodriveDell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting...7.1 High
- dnnsoftware dnnsoftware/dnn.platform, dotnetnuke +1 moreRelative Path Traversal in dnnsoftware/dnn.platform4.9 Medium
- carlo gavazzi cpy car park server, uwp 3.0 monitoring gateway and controller, uwp 3.0 monitoring gateway and controller – edp version +2 more +4 morePath traversal in Carlo Gavazzi UWP 3.0 could lead to full device access9.8 Critical
- linbreux wikmdWikmd vulnerable to Local File Enumeration when accessing /list7.5 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0...5.5 Medium
- abb zenonABB Ability TM Operations Data Management Zenon Zenon Log Server file access control5.9 Medium
- softing secure integration server, edgeaggregator, edgeconnector +3 more +5 moreSofting Secure Integration Server Relative Path Traversal7.2 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreZimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...9.8 Critical
- ovarro tbox, twinsoft, tbox lt2-530 firmware +6 more +8 moreOvarro TBox Relative Path Traversal7.5 High
- artica pfms pandora fms, pandora fms fms +1 moreRelative Path Traversal to Remote Code Execution in File Manager5.7 Medium
- advantech iviewAdvantech iView6.5 Medium
- tzinfo, debian linux +1 moreTZInfo relative path traversal vulnerability allows loading of arbitrary files7.5 High
- cisco nexus dashboardCisco Nexus Dashboard Arbitrary File Write Vulnerability4.9 Medium
- cisco unified communications managerCisco Unified Communications Manager Arbitrary File Read Vulnerability4.3 Medium
- elcomplus smarticsElcomplus SmartICS Path Traversal3.8 Low
- dell wyse management suiteDell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker...4.9 Medium
- offis dcmtkOFFIS DCMTK Path Traversal7.5 High
- keysight n6854a geolocation server and n6841a rf sensor software, n6841a rf firmware, n6854a firmware +2 moreKeysight N6854A Geolocation server and N6841A RF Sensor software7.5 High
- agg software web server (webserver.dll), aggsoft webserver +1 moreClaroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel6.5 Medium
- xinje xd/e series plc program tool, xd\/e series plc program tool +1 moreXinje XD/E Series PLC Program Tool Zip Slip7.3 High
- cisco unified communications managerCisco Unified Communications Products Arbitrary File Read Vulnerability6.5 Medium
- b. braun melsungen ag data module compactplus, spacecom, battery pack with wi-fi +1 more +3 moreB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus7.6 High
- sonicwall sma 210 firmware, sma 410 firmware, sma 500v firmware +3 more +5 more** UNSUPPORTED WHEN ASSIGNED ** A post-authentication arbitrary file read vulnerability impacting...4.9 Medium
- cisco telepresence video communication server, telepresence video communication server (vcs) expressway +1 moreCisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities9.0 Critical
- cisco telepresence video communication server, telepresence video communication server (vcs) expressway +1 moreCisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities9.0 Critical
- Show moreLoading…