CWE-35: Path Traversal: '.../...//'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- cisco network services orchestratorCisco Network Services Orchestrator Path Traversal Vulnerability5.3 Medium
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices8.1 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices6.5 Medium
- tcl cameraArbitrary file removal via path traversal in TCL Camera8.2 High
- thimpress wp hotel bookingWordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability7.5 High
- oakserver oakoak's path traversal allows transfer of hidden files within the served root directory7.7 High
- limb wordpress gallery plugin – limb image galleryWordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerability6.5 Medium
- multi-dncMulti-DNC – CWE-35: Path Traversal: '.../...//'7.5 High
- ex-themes wp timeline – vertical and horizontal timeline plugin, wp timeline +1 moreWordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability7.5 High
- agnaiAgnai vulnerable to Relative Path Traversal in Image Upload4.3 Medium
- agnaiAgnai File Disclosure Vulnerability: JSON via Path Traversal4.3 Medium
- agnaiAgnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal8.8 High
- axis communications ab osMarinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi...4.3 Medium
- trellix nx, ex, ax, fx, cms and ivxAn authenticated user can download sensitive files from Trellix products NX, EX, FX, AX, IVX, ...5.9 Medium
- mage mage-aiMage AI pipeline interaction request remote arbitrary file leak6.5 Medium
- nvidia mellanox os, metrox-3 xc, onyx +9 more +11 moreNVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support,...7.5 High
- dlink dap-1650 firmware**UNSUPPORTED WHEN ASSIGNED** Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1...9.3 Critical
- devitems ht megaWordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability6.5 Medium
- phpvibeDirectory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks,...9.8 Critical
- splunk, splunk enterprise +1 morePath Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows7.5 High
- 10web photo gallery by 10web – mobile-friendly image gallery, photo gallery +1 morePhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function6.8 Medium
- htmlyhtmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the...6.5 Medium
- filemanagerpro file managerFile Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal6.8 Medium
- sap asset accountingDirectory Traversal vulnerability in SAP Asset Accounting7.2 High
- lg led assistantPath traversal via file upload on LG LED Assistant5.3 Medium
- artica pandora fms, pandora fms fms +1 morePath Traversal and Untrusted Upload File6.7 Medium
- lg electronics signage, lg webos signage +1 moreAbsolute path traversal attack on LG Signage3.0 Low
- axis os, os 2020, os 2022 +2 moreInsufficient input validation in VAPIX API create_overlay.cgi5.4 Medium
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Path Traversal7.5 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Path Traversal8.8 High
- franklin electric fueling systems colibri, franklinfueling colibri firmware +1 moreFranklin Electric Fueling Systems Colibri Path Traversal6.5 Medium
- chameleon power power, hyphensolutions chameleon power +1 morePath traversal vulnerability in Chameleon Power products7.5 High
- axis os, os 2018, os 2020 +1 more +3 moreSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup...7.1 High
- axis os, os 2020, os 2022 +2 moreSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API...7.1 High
- axis os, os 2022 +1 moreSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API...7.1 High
- arduino create agent, arduino-create-agent +1 morePath traversal in Arduino Create Agent6.1 Medium
- arduino create agent, arduino-create-agent +1 morePath traversal in Arduino Create Agent7.1 High
- arduino create agent, arduino-create-agent +1 morePath traversal in Arduino Create Agent6.1 Medium
- axis os, os 2016, os 2018 +2 more +4 moreSandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del...6.5 Medium
- nlnet labs routinatorPossible path traversal when storing RRDP responses9.3 Critical
- splunk, splunk app for lookup file editing +1 morePath Traversal in Splunk App for Lookup File Editing8.1 High
- jetbrains ktorIn JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible7.5 High
- deytek informatics fileorbis file management system, fileorbis +1 morePath traversal in FileOrbis File Management System7.5 High
- zoom, zoom video communications inc for android +1 morePath Traversal in Zoom for Android Clients6.1 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be...6.2 Medium
- identity and directory management system project and directory management system, çekino bilgi teknolojileri bilgi teknolojileri +1 morePath traversal in Identity and Directory Management System7.5 High
- cyclonedx bill of materials repository server, cyclonedx-bom-repo-server +1 moreImproper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server7.1 High
- cisco unified communications manager, unified communications manager im and presence service +1 moreCisco Unified Communications Products Vulnerabilities6.5 Medium
- cisco unified communications manager, unified communications manager im and presence service +1 moreCisco Unified Communications Products Vulnerabilities6.5 Medium
- cisco unified communications manager, unified communications manager im and presence service +1 moreCisco Unified Communications Products Vulnerabilities6.5 Medium
- Show moreLoading…