Total
6537 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2024-44017 | 2024-10-04 | N/A | 7.5 HIGH | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through 1.3.2.1. | |||||
CVE-2021-27916 | 1 Acquia | 1 Mautic | 2024-10-02 | N/A | 8.1 HIGH |
Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic. | |||||
CVE-2024-47292 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | N/A | 5.5 MEDIUM |
Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
CVE-2024-8704 | 1 Advancedfilemanager | 1 Advanced File Manager | 2024-10-01 | N/A | 7.2 HIGH |
The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | |||||
CVE-2024-8941 | 1 Scriptcase | 1 Scriptcase | 2024-09-30 | N/A | 5.3 MEDIUM |
Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. | |||||
CVE-2024-6786 | 1 Moxa | 1 Mxview One | 2024-09-30 | N/A | 6.5 MEDIUM |
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets. | |||||
CVE-2024-8291 | 1 Concretecms | 1 Concrete Cms | 2024-09-30 | N/A | 4.8 MEDIUM |
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Thanks, Alexey Solovyev for reporting. | |||||
CVE-2024-46327 | 2024-09-30 | N/A | 5.7 MEDIUM | ||
An issue in the Http_handle object of VONETS VAP11G-300 v3.3.23.6.9 allows attackers to access sensitive files via a directory traversal. | |||||
CVE-2024-33369 | 2024-09-30 | N/A | 8.8 HIGH | ||
Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection method in DownloadTask | |||||
CVE-2024-47049 | 1 Czim | 1 File-handling | 2024-09-27 | N/A | 8.2 HIGH |
The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files. | |||||
CVE-2024-8671 | 1 Exthemes | 1 Wooevents | 2024-09-26 | N/A | 9.1 CRITICAL |
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). | |||||
CVE-2024-44825 | 2024-09-26 | N/A | 7.5 HIGH | ||
Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file. | |||||
CVE-2024-8538 | 1 Infiniteuploads | 1 Big File Uploads | 2024-09-26 | N/A | 4.3 MEDIUM |
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. | |||||
CVE-2024-46646 | 2024-09-26 | N/A | 6.5 MEDIUM | ||
eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file. | |||||
CVE-2024-43996 | 2024-09-26 | N/A | 6.5 MEDIUM | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0. | |||||
CVE-2024-46649 | 2024-09-26 | N/A | 7.5 HIGH | ||
eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder. | |||||
CVE-2024-44048 | 2024-09-26 | N/A | 6.5 MEDIUM | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce allows PHP Local File Inclusion.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through 1.9.10. | |||||
CVE-2023-26687 | 2024-09-26 | N/A | 8.8 HIGH | ||
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on. | |||||
CVE-2024-46644 | 2024-09-26 | N/A | 6.5 MEDIUM | ||
eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file. | |||||
CVE-2024-46647 | 2024-09-26 | N/A | 6.5 MEDIUM | ||
eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files. |