CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-22

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-6371 22 Dir. Trav. 2016-09-12 2016-09-12
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717.
2 CVE-2016-6370 22 Dir. Trav. 2016-09-12 2016-09-12
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255.
3 CVE-2016-6232 22 Dir. Trav. 2016-08-02 2016-08-03
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
4 CVE-2016-6138 22 Dir. Trav. 2016-08-05 2016-08-05
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.
5 CVE-2016-5664 22 Dir. Trav. 2016-08-26 2016-08-29
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI.
6 CVE-2016-5639 22 Dir. Trav. 2016-08-02 2016-08-15
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter.
7 CVE-2016-5332 22 Dir. Trav. 2016-08-30 2016-08-31
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectors.
8 CVE-2016-5098 22 Dir. Trav. 2016-07-04 2016-07-14
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.
9 CVE-2016-5092 22 Dir. Trav. 2016-07-13 2016-07-14
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging the autolearn feature.
10 CVE-2016-5049 22 Dir. Trav. 2016-08-26 2016-08-29
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
11 CVE-2016-4815 22 Dir. Trav. 2016-06-18 2016-06-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
12 CVE-2016-4814 22 Dir. Trav. 2016-06-18 2016-06-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
13 CVE-2016-4532 22 Dir. Trav. 2016-06-09 2016-06-10
6.4
None Remote Low Not required Partial Partial None
Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname.
14 CVE-2016-4004 22 Dir. Trav. 2016-04-12 2016-04-18
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ (dot dot backslash) in the file parameter to ViewFile.
15 CVE-2016-3976 22 Dir. Trav. 2016-04-07 2016-08-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
16 CVE-2016-3972 22 Dir. Trav. 2016-04-18 2016-04-19
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.
17 CVE-2016-2872 22 Dir. Trav. 2016-07-02 2016-07-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to read arbitrary files via a crafted URL.
18 CVE-2016-2389 22 Dir. Trav. 2016-02-16 2016-05-25
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.
19 CVE-2016-2289 22 Dir. Trav. 2016-04-01 2016-04-04
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors.
20 CVE-2016-2205 22 Dir. Trav. 2016-07-11 2016-07-12
6.1
None Local Network Low Not required Complete None None
Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 allows remote authenticated users to read unspecified application files via unknown vectors.
21 CVE-2016-2097 22 Dir. Trav. 2016-04-07 2016-04-11
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
22 CVE-2016-1671 22 Dir. Trav. 2016-05-14 2016-05-18
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and net/base/filename_util.cc.
23 CVE-2016-1610 22 Dir. Trav. Bypass 2016-07-31 2016-08-01
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
24 CVE-2016-1605 22 Dir. Trav. 2016-07-31 2016-08-01
6.8
None Remote Low Single system Complete None None
Directory traversal vulnerability in the ReportViewServlet servlet in the server in NetIQ Sentinel 7.4.x before 7.4.2 allows remote attackers to read arbitrary files via a PREVIEW value for the fileType field.
25 CVE-2016-1593 22 Dir. Trav. 2016-04-22 2016-04-28
6.5
None Remote Low Single system Partial Partial Partial
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL.
26 CVE-2016-1525 22 Dir. Trav. 2016-02-12 2016-03-10
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.
27 CVE-2016-1434 22 Dir. Trav. 2016-06-22 2016-06-23
4.0
None Remote Low Single system None Partial None
The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an invalid file, aka Bug ID CSCuz03010.
28 CVE-2016-1429 22 Dir. Trav. 2016-08-07 2016-08-11
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuz43023.
29 CVE-2016-1231 22 Dir. Trav. 2016-01-12 2016-06-15
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.
30 CVE-2016-1223 22 Dir. Trav. 2016-06-18 2016-06-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors.
31 CVE-2016-1212 22 Dir. Trav. 2016-06-04 2016-06-06
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
32 CVE-2016-1192 22 Dir. Trav. 2016-06-19 2016-06-21
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.
33 CVE-2016-1191 22 Dir. Trav. 2016-06-19 2016-06-21
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
34 CVE-2016-1145 22 Dir. Trav. 2016-01-30 2016-03-10
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote attackers to read arbitrary files via unspecified vectors.
35 CVE-2016-0855 22 Dir. Trav. 2016-01-14 2016-01-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
36 CVE-2016-0784 22 Dir. Trav. 2016-04-11 2016-04-14
4.0
None Remote Low Single system None Partial None
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
37 CVE-2016-0752 22 Dir. Trav. 2016-02-15 2016-03-03
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
38 CVE-2016-0709 22 Exec Code Dir. Trav. 2016-04-11 2016-04-20
9.0
None Remote Low Single system Complete Complete Complete
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
39 CVE-2015-8799 22 Dir. Trav. 2016-06-08 2016-06-10
7.1
None Remote High Single system Complete Complete Complete
Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.
40 CVE-2015-8798 22 Exec Code Dir. Trav. 2016-06-08 2016-06-10
7.7
None Local Network Low Single system Complete Complete Complete
Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.
41 CVE-2015-8794 22 Dir. Trav. 2016-01-29 2016-02-25
4.0
None Remote Low Single system Partial None None
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
42 CVE-2015-8770 22 Exec Code Dir. Trav. 2016-01-29 2016-02-23
6.0
None Remote Medium Single system Partial Partial Partial
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
43 CVE-2015-8565 22 Dir. Trav. 2015-12-16 2015-12-17
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
44 CVE-2015-8564 22 Dir. Trav. 2015-12-16 2015-12-17
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
45 CVE-2015-8358 22 Dir. Trav. 2015-12-16 2015-12-17
9.0
None Remote Low Single system Complete Complete Complete
Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
46 CVE-2015-8357 22 DoS Dir. Trav. +Info 2015-12-16 2015-12-17
6.5
None Remote Low Single system Partial Partial Partial
Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequently obtain sensitive information or cause a denial of service, via a .. (dot dot) in the file parameter to admin/bitrix.xscan_worker.php.
47 CVE-2015-8228 22 Dir. Trav. 2015-11-24 2015-11-25
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors.
48 CVE-2015-7907 22 Dir. Trav. Bypass 2015-12-21 2015-12-22
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
49 CVE-2015-7815 22 Dir. Trav. 2015-11-16 2015-11-17
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter.
50 CVE-2015-7603 22 Dir. Trav. 2015-09-29 2015-09-30
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Total number of vulnerabilities : 1887   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.