CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- fortinet forticlient, forticlientmac +1 moreAn external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3...7.8 High
- voila-dashboards voilaVoilà Local file inclusion7.5 High
- open automation software oas platform, openautomationsoftware open automation software +1 moreA file write vulnerability exists in the OAS Engine Save Security Configuration functionality of...4.9 Medium
- open automation software oas platform, openautomationsoftware open automation software +1 moreA file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open...4.9 Medium
- campcodes house rental management systemCampcodes House Rental Management System index.php file inclusion5.4 Medium
- paddlepaddle paddle, paddlepaddle, paddlepaddle paddlepaddle/paddle +2 moreconfirmed8.2 High
- geoserverGeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API6.0 Medium
- advancedplugins reportsstatisticsAn issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to...9.8 Critical
- ibm secure proxy, sterling secure proxy +1 moreIBM Secure Proxy file manipulation5.9 Medium
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 version 23h2 +2 more +4 moreWindows Compressed Folder Tampering Vulnerability6.5 Medium
- ibm watson cp4d data storesIBM Watson CP4D Data Stores file modificiation4.2 Medium
- mayurik best pos management systemSourceCodester Best POS Management System index.php file inclusion4.3 Medium
- itsourcecode insurance management systemSourceCodester Insurance Management System file inclusion5.3 Medium
- dompdf php-svg-libphp-svg-lib lacks path validation on font through SVG inline styles6.8 Medium
- devfile registry-support, red hat openshift developer tools and services, openshift container platform 4 +1 more +3 moreRegistry-support: decompress can delete files outside scope via relative paths8.0 High
- leanote, leanote desktop +1 moreLeanote 2.7.0 - Local File Read5.0 Medium
- cloudlinux cagefsCloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail...4.4 Medium
- foru cmsForU CMS channel.php file inclusion4.7 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the image404Raw.php functionality of WWBN...7.5 High
- wwbn avideoA local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN...9.8 Critical
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows HTML Platforms Security Feature Bypass Vulnerability8.1 High
- oretnom23 clinic queuing systemSourceCodester Clinic Queuing System GET Parameter index.php file inclusion6.3 Medium
- h2o, h2oai h2oai/h2o-3 +1 moreExternal Control of File Name or Path in h2oai/h2o-39.3 Critical
- dompdf php-svg-libphp-svg-lib possible DoS caused by infinite recursion when parsing SVG document5.3 Medium
- microsoft power platform, azure logic apps +1 moreMicrosoft Power Platform Connector Spoofing Vulnerability9.6 Critical
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System index.php file inclusion5.5 Medium
- mitsubishi electric melsoft iq appportal, motion control setting, mitsubishi electric corporation gx works3 +1 more +3 moreMalicious Code Execution Vulnerability due to External Control of File Name or Path in multiple...7.8 High
- foxit reader, foxitsoftware foxit reader +1 moreA code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356....8.8 High
- foxit reader, foxitsoftware foxit reader +1 moreAn arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit...8.8 High
- foxit reader, foxitsoftware foxit reader +1 moreAn arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit...8.8 High
- aveva application server, batch management, communication drivers pack +19 more +21 moreAVEVA Operations Control Logger External Control of File Name or Path5.5 Medium
- apache alluraApache Allura: sensitive information exposure via import4.9 Medium
- cisco firepower management center, secure firewall management center +1 moreA vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software...6.5 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated...5.2 Medium
- fortinet fortiap-uAn incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in...6.5 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability8.8 High
- david lingren media library assistantMedia Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution9.8 Critical
- open automation software oas platformA file write vulnerability exists in the OAS Engine configuration functionality of Open...6.5 Medium
- code-projects inventory management systemSourceCodester Inventory Management System index.php file inclusion6.3 Medium
- cisco adaptive security appliance (asa) software, firepower extensible operating system (fxos), firepower threat defense software +1 more +3 moreA vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to...4.4 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +20 more +22 moreWindows HTML Platforms Security Feature Bypass Vulnerability5.4 Medium
- resort reservation system project reservation system, sourcecodester resort reservation system +1 moreSourceCodester Resort Reservation System index.php file inclusion6.3 Medium
- carel boss mini firmwareBoss Mini document file inclusion7.3 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +19 more +21 moreWindows MSHTML Platform Security Feature Bypass Vulnerability6.5 Medium
- advantech r-seenetAdvantech R-SeeNet External Control of File Name or Path8.8 High
- zoom virtual desktop infrastructure, zoom video communications, inc. vdi windows meeting client +1 moreZoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A...7.7 High
- Show moreLoading…