CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (Directory Traversal)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-5353 22 Dir. Trav. 2015-07-01 2015-07-02
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tab parameter to admin/.
2 CVE-2015-5149 22 Dir. Trav. 2015-06-30 2015-07-01
5.5
None Remote Low Single system None Partial Partial
Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
3 CVE-2015-5065 22 Dir. Trav. 2015-06-24 2015-06-24
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
4 CVE-2015-4641 22 Exec Code Dir. Trav. 2015-06-19 2015-06-22
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a ZIP archive, as demonstrated by a traversal to the /data/dalvik-cache directory.
5 CVE-2015-4616 22 Dir. Trav. 2015-07-08 2015-07-15
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. (dot dot) in the map_id parameter.
6 CVE-2015-4527 200 Dir. Trav. +Info 2015-07-23 2015-07-24
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition (AVE) 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters.
7 CVE-2015-4415 22 Dir. Trav. 2015-06-10 2015-06-11
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in func.php in Magnifica Webscripts Anima Gallery 2.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) theme or (2) lang cookie parameter to AnimaGallery/.
8 CVE-2015-4414 22 Dir. Trav. 2015-06-17 2015-06-18
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
9 CVE-2015-4289 Dir. Trav. 2015-07-31 2015-07-31
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920.
10 CVE-2015-4153 22 Dir. Trav. 2015-06-10 2015-06-11
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
11 CVE-2015-4152 22 Dir. Trav. 2015-06-15 2015-06-16
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
12 CVE-2015-4068 22 DoS Dir. Trav. +Info 2015-05-29 2015-06-02
9.4
None Remote Low Not required Complete None Complete
Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
13 CVE-2015-4031 22 Dir. Trav. 2015-05-29 2015-06-01
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in saveFile.jsp in the development installation in Visual Mining NetChart allows remote attackers to write to arbitrary files via unspecified vectors.
14 CVE-2015-3986 352 Dir. Trav. CSRF 2015-05-14 2015-05-15
4.3
None Remote Medium Not required Partial None None
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
15 CVE-2015-3939 22 Dir. Trav. 2015-05-31 2015-06-02
6.8
None Remote Low Single system Complete None None
Directory traversal vulnerability in the NC854 and NC856 modules for IDS RTU 850C devices allows remote authenticated users to read arbitrary files via unspecified vectors involving an internal web server, as demonstrated by reading a TELNET credentials file.
16 CVE-2015-3897 22 Dir. Trav. 2015-06-18 2015-06-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.
17 CVE-2015-3648 22 Dir. Trav. 2015-06-09 2015-06-10
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultlanguage parameter.
18 CVE-2015-3337 22 Dir. Trav. 2015-05-01 2015-06-25
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
19 CVE-2015-3301 22 Dir. Trav. 2015-05-14 2015-05-15
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
20 CVE-2015-3035 22 Dir. Trav. 2015-04-21 2015-07-07
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
21 CVE-2015-2997 200 Dir. Trav. +Info 2015-06-08 2015-06-09
5.0
None Remote Low Not required Partial None None
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
22 CVE-2015-2996 22 DoS Dir. Trav. 2015-06-08 2015-06-09
8.5
None Remote Low Not required Partial None Complete
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
23 CVE-2015-2995 22 Dir. Trav. 2015-06-08 2015-06-09
6.8
None Remote Medium Not required Partial Partial Partial
SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
24 CVE-2015-2971 22 Dir. Trav. 2015-07-19 2015-07-23
5.5
None Remote Low Single system None Partial Partial
Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
25 CVE-2015-2970 22 Dir. Trav. 2015-07-10 2015-07-13
6.4
None Remote Low Not required None Partial Partial
index.php in LEMON-S PHP Simple Oekaki BBS before 1.21 allows remote attackers to delete arbitrary files via the oekakis parameter.
26 CVE-2015-2966 22 Dir. Trav. 2015-06-30 2015-07-01
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the Droidware UK Explorer+ File Manager application before 2.3.3 for Android allows remote attackers to write to arbitrary files via unspecified vectors.
27 CVE-2015-2965 22 Dir. Trav. 2015-06-28 2015-06-29
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
28 CVE-2015-2950 22 Dir. Trav. 2015-06-05 2015-06-05
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the Brandon Bowles Open Explorer application before 0.254 Beta for Android allows remote attackers to write to arbitrary files via a crafted filename.
29 CVE-2015-2862 22 Dir. Trav. 2015-07-20 2015-07-22
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
30 CVE-2015-2860 22 Dir. Trav. 2015-06-23 2015-06-24
7.8
None Remote Low Not required Complete None None
Directory traversal vulnerability in Avigilon Control Center (ACC) 4 before 4.12.0.54 and 5 before 5.4.2.22 allows remote attackers to read arbitrary files via a crafted help/ URL.
31 CVE-2015-2775 22 Dir. Trav. 2015-04-13 2015-07-13
7.6
None Remote High Not required Complete Complete Complete
Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
32 CVE-2015-2304 22 Dir. Trav. 2015-03-15 2015-04-01
6.4
None Remote Low Not required None Partial Partial
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
33 CVE-2015-2243 22 Dir. Trav. 2015-03-09 2015-03-10
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
34 CVE-2015-2166 22 Dir. Trav. 2015-04-06 2015-04-07
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI.
35 CVE-2015-2071 22 1 Dir. Trav. 2015-02-24 2015-02-25
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter.
36 CVE-2015-2067 22 1 Dir. Trav. 2015-02-24 2015-02-25
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
37 CVE-2015-1884 22 Dir. Trav. 2015-06-28 2015-06-29
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL.
38 CVE-2015-1589 22 Dir. Trav. 2015-02-23 2015-02-24
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.
39 CVE-2015-1579 22 1 Dir. Trav. 2015-02-11 2015-07-14
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
40 CVE-2015-1577 22 1 Dir. Trav. 2015-02-11 2015-02-12
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter.
41 CVE-2015-1551 264 Dir. Trav. 2015-05-28 2015-05-29
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.
42 CVE-2015-1550 22 Dir. Trav. 2015-05-28 2015-05-29
9.0
None Remote Low Single system Complete Complete Complete
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors.
43 CVE-2015-1493 22 Dir. Trav. 2015-06-01 2015-06-02
6.8
None Remote Low Single system Complete None None
Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.
44 CVE-2015-1490 Dir. Trav. 2015-07-31 2015-07-31
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package.
45 CVE-2015-1398 22 Exec Code Dir. Trav. 2015-04-29 2015-05-11
6.5
None Remote Low Single system Partial Partial Partial
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
46 CVE-2015-1365 22 1 Dir. Trav. 2015-01-27 2015-01-29
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
47 CVE-2015-1322 22 Dir. Trav. 2015-04-29 2015-04-30
4.6
None Local Low Not required Partial Partial Partial
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or ready arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
48 CVE-2015-1195 22 Dir. Trav. 2015-01-21 2015-01-25
6.5
None Remote Low Single system Partial Partial Partial
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
49 CVE-2015-1193 22 Dir. Trav. 2015-01-21 2015-01-23
5.0
None Remote Low Not required None Partial None
Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
50 CVE-2015-1192 22 Dir. Trav. 2015-01-21 2015-01-23
5.0
None Remote Low Not required None Partial None
Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.
Total number of vulnerabilities : 2890   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.