ThinVNC 1.0b1 is vulnerable to arbitrary file read which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.


Koji through 1.18.0 allows remote Directory Traversal with resultant Privilege Escalation.


ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file because they can inject a content with crafted template. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.


Jiangnan

Online

Judge

(aka

jnoj)

has

Directory

Traversal

for

file

reading

via

the

web/polygon/problem/viewfile?id=1&name=../

substring.


/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary files.


A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks) it would delete the target destination. If that destination was hidden behind a symlink a malicious gem could delete arbitrary files on the user's machine presuming the attacker could guess at paths. Given how frequently gem is run as sudo and how predictable paths are on modern systems (/tmp /usr etc.) this could likely lead to data loss or an unusable system.


FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\\ or index.php?s=Admin-Data-Del-id-..\\ directory traversal.


admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.


A directory traversal vulnerability in the web application in McAfee (now Intel Security) SaaS Control Console (SCC) Platform 6.14 before patch 1070 and 6.15 before patch 1076 allows unauthenticated users to view contents of arbitrary system files that did not have file system level read access restrictions via a null-byte injection exploit.


Multiple directory traversal vulnerabilities in iScripts AutoHoster possibly 2.4 allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php (2) fname parameter to admin/downloadfile.php or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.


Directory

traversal

vulnerability

in

in

Google

Chrome

before

on

Windows

allows

attackers

to

bypass

intended

named-pipe

policy

restrictions

in

the

sandbox

via

vectors

related

to

lack

of

checks

for

(dot

dot)

sequences

or

lack

of

use

of

the

protection

mechanism.


The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls which allows remote attackers to create or overwrite arbitrary files and subsequently execute arbitrary programs via the two pathname arguments as demonstrated by a directory traversal attack.


Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3 15.5 before 15.5 ESD#5.3 and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to affect confidentiality integrity and availability via unspecified vectors.


Directory traversal vulnerability in IBM Algo One as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0 and ACSWeb in AlgoWebApps 5.0.0 allows remote authenticated users to read arbitrary files via unspecified vectors.


Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors as demonstrated by reading the /etc/passwd file.


Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read write and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi (5) file_download.cgi (6) file_sharing.cgi (7) file_MVCP.cgi or (8) file_rename.cgi in webapi/FileStation/.


Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47 4.2 before Patch 26 and 4.5 before Patch 05 as used in Documentum Edition Enterprise Edition Publish Engine and Enterprise Edition Compuset Engine allows remote authenticated users to read arbitrary files by leveraging xDashboard access.


The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveToFile method calls which allows remote attackers to create or overwrite arbitrary files and subsequently execute arbitrary programs via the single pathname argument as demonstrated by a directory traversal attack.


Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager (ELM) component in Cisco Unified Communications Manager 9.1(1) and earlier allows remote authenticated users to create arbitrary files via a crafted path aka Bug ID CSCui58222.


Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/ when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.


Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x 8.x through 8.6 8.7 before FP2 and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter as demonstrated using a crafted request for a customer-support file as demonstrated by a log file.


Directory traversal vulnerability in File Roller 3.6.x before 3.6.4 3.8.x before 3.8.3 and 3.9.x before 3.9.3 when libarchive is used allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a \Keep directory structure\ action related to fr-archive-libarchive.c and fr-window.c.


Directory traversal vulnerability in Django 1.4.x before 1.4.7 1.5.x before 1.5.3 and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.


The http-domino-enum-passwords.nse script in NMap before 6.40 when domino-enum-passwords.idpath is set allows remote servers to upload \arbitrarily named\ files via a crafted FullName parameter in a response as demonstrated using directory traversal sequences.


Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation (2) Service (3) Style (4) Validate or (5) Version value.


Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request aka Bug ID CSCuh69773.


Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in a URI as demonstrated by a request for /etc/passwd.


Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection allows remote authenticated users to create files and consequently execute arbitrary JSP code via a crafted pathname for a file that is not a valid audio file aka Bug ID CSCuj22948.


Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string aka Bug ID CSCui78815.


Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the file parameter in a (1) download or (2) get_content action or (3) upload arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the dir parameter in an upload action.


Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/.


The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp which allows remote attackers to conduct directory traversal attacks and consequently upload and execute arbitrary programs via a request to TCP port 443.


Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.


Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.


Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted (1) HTTP or (2) HTTPS request that triggers incorrect parameter validation aka Bug ID CSCub38369.


Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content and hijack user accounts via a crafted URL aka \SharePoint Directory Traversal Vulnerability.\


Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0 FirePass 6.0.0 through 6.1.0 and 7.0.0 and other products \when APM is provisioned \ allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.


Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0 and Proficy Process Systems with CIMPLICITY allows remote attackers to read arbitrary files via a crafted packet.


Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 7.0 before 7.0.0.29 8.0 before 8.0.0.6 and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.


Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel as demonstrated by writing to the Software/ directory.


rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable probably a directory traversal vulnerability that is remotely exploitable aka \symlink path traversals.\


The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters which allows remote attackers to conduct directory traversal attacks via a crafted directory name.


Directory traversal vulnerability in the web interface on Foscam devices with firmware before 11.37.2.49 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI as demonstrated by discovering (1) web credentials or (2) Wi-Fi credentials.


Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log (2) upload or (3) linuxpkgs method.


The Loftek Nexus 543 IP Camera stores passwords in cleartext which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311.


Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin a different vulnerability than CVE-2013-7376. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.


Directory

traversal

vulnerability

in

the

lfCheckFileName

function

in

in

LOCKON

EC-CUBE

before

allows

remote

attackers

to

read

arbitrary

image

files

via

vectors

involving

the

image

parameter

to

a

different

vulnerability

than


Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php a different vulnerability than CVE-2013-3650.


The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files including sensitive configuration files such as wp-config.php to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.


In NASCENT RemKon Device Manager 4.0.0.0 a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL.


The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter which could be prepended with \../\ to perform directory traversal and the file contents were populated via the ibsf parameter which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames a double extension attack was still possible e.g. a file named shell.php would be saved as shell.php.jpg and would be executable on a number of common configurations.


unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.


In Django 2.2 before 2.2.20 3.0 before 3.0.14 and 3.1 before 3.1.8 MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.


autoar-extractor.c in GNOME gnome-autoar before 0.3.1 as used by GNOME Shell Nautilus and other software allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.


ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.


ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.


Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g. ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in the web server will allow a download of the contents of the /etc/passwd file.


BTCPay Server through 1.0.7.0 suffers from directory traversal which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.


Directory

traversal

in

Northstar

Technologies

Inc

NorthStar

Club

Management

allows

remote

unauthenticated

users

to

browse

and

list

the

directories

across

the

entire

filesystem

of

the

host

of

the

web

application.


In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.


ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated remote attacker to perform directory traversal attacks and read arbitrary files on the system.


The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.


A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80 1.81 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality integrity and availability of the iLO Amplifier Pack appliance.


Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code involving an encoded slash.


ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.


In Open-iSCSI tcmu-runner 1.3.x 1.4.x and 1.5.x through 1.5.2 xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374 this is a similar mistake in a different algorithm.


Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.


In Django 2.2 before 2.2.18 3.0 before 3.0.12 and 3.1 before 3.1.6 the django.utils.archive.extract method (used by \startapp --template\ and \startproject --template\) allows directory traversal via an archive with absolute paths or relative paths with dot segments.


A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated local attacker to overwrite files on the file system of an affected device by using directory traversal techniques. A successful exploit could cause system instability if important system files are overwritten. This vulnerability is due to insufficient validation of user input for the file path in a specific CLI command. An attacker could exploit this vulnerability by logging in to a targeted device and issuing a specific CLI command with crafted user input. A successful exploit could allow the attacker to overwrite arbitrary files on the file system of the affected device. The attacker would need valid user credentials on the device.


A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the device does not properly validate URIs in IOx API requests. An attacker could exploit this vulnerability by sending a crafted API request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system.


A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to conduct path traversal attacks and obtain write access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to write arbitrary files on the affected system.


MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server as demonstrated by the /loginLess/../../etc/passwd URI.


All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request.


On BIG-IP on all versions of 16.1.x 16.0.x 15.1.x 14.1.x 13.1.x 12.1.x and 11.6.x a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server as demonstrated by the /../../conf/template/uhttpd.json URI.


In iCMS <=8.0.0 a directory traversal vulnerability allows an attacker to read arbitrary files.


Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card an attacker can navigate through the device's File System over HTTP.


KNIME Server before 4.13.4 allows directory traversal in a request for a client profile.


There is a Directory traversal vulnerability in Caucho Resin as distributed in Resin 4.0.52 - 4.0.56 which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.


An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal.


A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Cisco Unified Communications Manager Session Management Edition (Unified CM SME) Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) and Cisco Unity Connection could allow an authenticated remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.


LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. This deletion is possible via directory traversal in the uploadImg oldpic or imgurl parameter.


Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2


Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information as well as allowing Author+ users to perform XSS attacks by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.


A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2 which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).


Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information.


Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal.


An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.


Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0.


Directory

Traversal

vulnerability

exists

in

ZZCMS

via

the

skin

parameter

in

index.php

bottom.php

and


Storage.save in Django 2.2 before 2.2.26 3.2 before 3.2.11 and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.


HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.


Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal which may allow an attacker to read sensitive files.


There is a Directory traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.


When loading a specially crafted file Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 and Luxion KeyVR versions prior to 10.1 are while processing the extraction of temporary files suffering from a directory traversal vulnerability which allows an attacker to store arbitrary scripts into automatic startup folders.


The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.


An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges.


NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder a file for the inbuilt Out-Going Message function or a file for the the inbuilt Autodial function.


CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file \bl_categories_help.php\ is vulnerable to directory traversal an attacker can create a file that contains scripts and run arbitrary commands.


Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability which allows an attacker to obtain sensitive information.


Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability which allows an attacker to obtain sensitive information.


An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.


An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.


Synerion TimeNet version 9.21 contains a directory traversal vulnerability where on the \Name\ parameter the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files which could provide the attacker with more information required to further compromise the system.


Under specific circumstances SAP Master Data Management versions - 710 710.750 allows an unauthorized attacker to exploit insufficient validation of path information provided by users thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data.


A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to arbitrary file deletion. An attacker can make an authenticated HTTP request to trigger this vulnerability.


Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.


A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to local file inclusion. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to arbitrary file overwrite FsTFtp file disclosure. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.


spring-boot-actuator-logview

in

a

library

that

adds

a

simple

logfile

viewer

as

spring

boot

actuator

endpoint.

It

is

maven

package

\eu.hinsch:spring-boot-actuator-logview\.

In

spring-boot-actuator-logview

before

version

there

is

a

directory

traversal

vulnerability.

The

nature

of

this

library

is

to

expose

a

log

file

directory

via

admin

(spring

boot

actuator)

HTTP

endpoints.

Both

the

filename

to

view

and

a

base

folder

(relative

to

the

logging

folder

root)

can

be

specified

via

request

parameters.

While

the

filename

parameter

was

checked

to

prevent

directory

traversal

exploits

(so

that

`filename=../somefile`

would

not

work)

the

base

folder

parameter

was

not

sufficiently

checked

so

that

`filename=somefile&base=../`

could

access

a

file

outside

the

logging

base

directory).

The

vulnerability

has

been

patched

in

release

Any

users

of

should

be

able

to

update

without

any

issues

as

there

are

no

other

changes

in

that

release.

There

is

no

workaround

to

fix

the

vulnerability

other

than

updating

or

removing

the

dependency.

However

removing

read

access

of

the

user

the

application

is

run

with

to

any

directory

not

required

for

running

the

application

can

limit

the

impact.

Additionally

access

to

the

logview

endpoint

can

be

limited

by

deploying

the

application

behind

a

reverse

proxy.


A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP request can lead to local file inclusion. An attacker can make an authenticated HTTP request to trigger this vulnerability.


Specially-crafted command line arguments can lead to arbitrary file deletion. The handle_delete function does not attempt to sanitize or otherwise validate the contents of the file parameter (passed to the function as argv1) allowing an authenticated attacker to supply directory traversal primitives and delete semi-arbitrary files.


SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation this allows an authenticated attacker to perform various security attacks like Directory Traversal Password Brute force Attack SMB Relay attack Security Downgrade.


Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal which may allow an attacker to remotely read arbitrary files on the file system.


An issue was discovered in JUMP AMS 3.6.0.04.009-2487. A JUMP SOAP endpoint permitted the writing of arbitrary files to a user-controlled location on the remote filesystem (with user-controlled content) via directory traversal potentially leading to remote code and command execution.


Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabling remotely connected clients to destroy and/or manipulate critical files on the host's file system. This security bug has been patched in version 0.5.1. There are no known workarounds aside from upgrading.


S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket as demonstrated by a <Key>../ substring in a ListBucketResult element.


Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning as demonstrated by reading the /etc/passwd file.


An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem aka directory traversal.


Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of sensitive data on the vulnerable server.


It

was

discovered

that

the

SteelCentral

AppInternals

Dynamic

Sampling

Agent's

(DSA)

AgentConfigurationServlet

has

directory

traversal

vulnerabilities

at

the

\/api/appInternals/1.0/agent/configuration\

API.

The

affected

endpoint

does

not

have

any

input

validation

of

the

user's

input

that

allows

a

malicious

payload

to

be

injected.


It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the \/api/appInternals/1.0/agent/da/pcf\ API. The affected endpoint does not have any validation of the user's input that allows a malicious payload to be injected.


It

was

discovered

that

the

SteelCentral

AppInternals

Dynamic

Sampling

Agent's

(DSA)

AgentDiagnosticServlet

has

directory

traversal

vulnerability

at

the

\/api/appInternals/1.0/agent/diagnostic/logs\

API.

The

affected

endpoint

does

not

have

any

input

validation

of

the

user's

input

that

allows

a

malicious

payload

to

be

injected.


Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive an attacker has arbitrary write capability within specific directories via a crafted archive file.


It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the \/api/appInternals/1.0/plugin/pmx\ API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.


Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal leading to code execution.


condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory as demonstrated by creating a file under /etc that will later be executed by root.


node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API used in file hue-magic.js to fetch an arbitrary file.


An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.


AlquistManager

branch

as

of

commit

is

affected

by

a

directory

traversal

vulnerability

in

This

attack

can

cause

the

disclosure

of

critical

secrets

stored

anywhere

on

the

system

and

can

significantly

aid

in

getting

remote

code

access.


Wiki.js

is

a

wiki

app

built

on

Node.js.

Prior

to

version

directory

traversal

outside

of

Wiki.js

context

is

possible

when

a

storage

module

with

local

asset

cache

fetching

is

enabled

on

a

Windows

host.

A

malicious

user

can

potentially

read

any

file

on

the

file

system

by

crafting

a

special

URL

that

allows

for

directory

traversal.

This

is

only

possible

on

a

Wiki.js

server

running

on

Windows

when

a

storage

module

implementing

local

asset

cache

(e.g

Local

File

System

or

Git)

is

enabled

and

that

no

web

application

firewall

solution

(e.g.

cloudflare)

strips

potentially

malicious

URLs.

Commit

number

fixes

this

vulnerability

by

sanitizing

the

path

before

it

is

passed

on

to

the

storage

module.

The

sanitization

step

removes

any

windows

directory

traversal

sequences

from

the

path.

As

a

workaround

disable

any

storage

module

with

local

asset

caching

capabilities

(Local

File

System

Git).


OpenCV-REST-API

master

branch

as

of

commit

is

affected

by

a

directory

traversal

vulnerability.

This

attack

can

cause

the

disclosure

of

critical

secrets

stored

anywhere

on

the

system

and

can

significantly

aid

in

getting

remote

code

access.


An Archive Extraction (AKA \Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).


Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.


kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.


Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//` where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7 8.1.8 8.2.7 or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths mitigation and the disclosure timeline.


Clustering

master

branch

as

of

commit

is

affected

by

a

directory

traversal

vulnerability.

This

attack

can

cause

the

disclosure

of

critical

secrets

stored

anywhere

on

the

system

and

can

significantly

aid

in

getting

remote

code

access.


AlquistManager

branch

as

of

commit

is

affected

by

a

directory

traversal

vulnerability.

This

attack

can

cause

the

disclosure

of

critical

secrets

stored

anywhere

on

the

system

andcan

significantly

aid

in

getting

remote

code

access.


Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively for fully lowercase or fully uppercase .md files users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.


ServerManagement

master

branch

as

of

commit

is

affected

by

a

directory

traversal

vulnerability.

This

vulnerability

can

be

used

to

extract

credentials

which

can

in

turn

be

used

to

execute

code.


In Druid 1.2.3 visiting the path with parameter in a certain function can lead to directory traversal.


Django before 2.2.24 3.x before 3.1.12 and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally if (and only if) the default admindocs templates have been customized by application developers to also show file contents then not only the existence but also the file contents would have been exposed. In other words there is directory traversal outside of the template root directories.


Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.


Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.


An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal.


Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.


A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files causing the application to become unavailable to all users.


Directory traversal in the Copy Move and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files (or Cells files belonging to any user) via the nodes parameter (for Copy and Move) or via the Path parameter (for Delete).


mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead to code execution.


Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.


Payara Micro Community 5.2021.6 and below allows Directory Traversal.


squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.


SerenityOS

before

commit

contains

a

directory

traversal

vulnerability

in

tar/unzip

that

may

lead

to

command

execution

or

privilege

escalation.


In Django 2.2 before 2.2.21 3.1 before 3.1.9 and 3.2 before 3.2.1 MultiPartParser UploadedFile and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.


Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files resulting in directory traversal and potentially arbitrary code execution.


Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.


A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit with PHP code in the html parameter.


A

directory

traversal

issue

was

discovered

in

Gradle

gradle-enterprise-test-distribution-agent

before

test-distribution-gradle-plugin

before

and

gradle-enterprise-maven-extension

before

A

malicious

actor

(with

certain

credentials)

can

perform

a

registration

step

such

that

crafted

TAR

archives

lead

to

extraction

of

files

into

arbitrary

filesystem

locations.


An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials) as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_user account (with caldav_public_user as its password).


The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal.


An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3 when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.


ImpressCMS

before

allows

Directory

Traversal.


Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information such as a password or decryption key.


and

in

Bolt

before

allow

Directory

Traversal.


The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation aka Directory Traversal.


isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.


Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.


There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255 and VMware appliance 4.30.000000 through SP273) via the filename parameter to /cgi-bin/main.cgi.


A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.


Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.


DISPUTED

The

mkdocs

built-in

dev-server

allows

directory

traversal

using

the

port

enabling

remote

exploitation

to

obtain

:sensitive

information.

NOTE:

the

vendor

has

disputed

this

as

described

in

and


Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.


Bajie HTTP web server 0.30a allows remote attackers to read arbitrary files via a URL that contains a \....\ a variant of the dot dot directory traversal attack.


Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via \..\ (dot dot) sequences in the default .langfile name field in the Master Settings administrative function which causes the file to be displayed in admin.php3.


Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overwrite arbitrary files via a .. (dot dot) in the (1) fichier or (2) repertoire parameter or create arbitrary directories via a .. (dot dot) in the (3) repertoire parameter.


** DISPUTED ** Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3 when register_globals is enabled allows remote attackers to read arbitrary local files via a .. (dot dot) in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argument when invoking fputs which cannot be used to read files.


Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive a related issue to CVE-2001-1267.


Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic and 7.0.3.3016 allows remote attackers to create or overwrite arbitrary local files via a ..\\ (dot dot backslash) in the second argument to the DownloadFromMusicStore method. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for code execution by overwriting JetAudio.exe which is launched by the control after completion of the method call.


Directory traversal vulnerability in pawfaliki.php in Pawfaliki 0.5.1 allows remote attackers to list arbitrary files via a .. (dot dot) in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method probably related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll.


The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method probably a directory traversal vulnerability.


Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 in Microsoft Visual Studio 6.0 allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveAs method. NOTE: contents can be copied from local files via the Load method.


Visual truncation vulnerability in WinImage 8.10 and earlier allows remote attackers to spoof a destination filename via a long sequence of space characters in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged with a separate directory traversal vulnerability to trick a careful user into overwriting arbitrary files.


Directory traversal vulnerability in Enriva Development Magellan Explorer 3.32 build 2305 and earlier allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via \..\\\ (dot dot backslash) sequences in a filename. NOTE: the \..\\\ are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote authenticated administrators with certain TFTP privileges to create and overwrite arbitrary files via a .. (dot dot) in a pathname. NOTE: this can be leveraged for administrative access by overwriting /etc/shadow.


Multiple directory traversal vulnerabilities in CGI RESCUE Shopping Basket Professional 7.51 and earlier allow remote attackers to list arbitrary directories and possibly read arbitrary files via directory traversal sequences in unspecified parameters to (1) list.cgi or (2) list2.cgi.


Directory traversal vulnerability in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary files via a .. (dot dot) in an unspecified environment variable which is appended to \/tmp/\ and used as a log file. NOTE: this issue might be related to symlink following.


Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method which writes text specified by the addsetConfig method possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.


Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0 and possibly later versions such as 6.482 allow remote attackers to read arbitrary files via a .. (dot dot) in the view_mode parameter to (1) featured_list.php and (2) online_list.php in member/.


Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the admin_home parameter to modules/poll/poll_summary.php or (2) the rootdp parameter to include/db.php.


** DISPUTED ** Directory traversal vulnerability in PageTraiteDownload.php in phpMyConferences 8.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter. NOTE: this issue is disputed for 8.0.2 by a reliable third party who notes that the PHP code is syntactically incorrect and cannot be executed.


Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1) error_handler_file and (2) local_php parameters to (a) tiki-index.php or (3) encoded \..%2F\ sequences in the imp_language parameter to tiki-imexport_languages.php.


The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read files via a combination of \..\ and sub-directory specifiers that resolve to a pathname that is at or below the same level as the web document root but in a different part of the directory tree.


Directory traversal vulnerability in fileSystem.do in SSL-Explorer before 0.2.14 allows remote attackers to access arbitrary files via directory traversal sequences in the path parameter. NOTE: some of these details are obtained from third party information.


Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lng parameter to (a) guestbook.php (b) admin/admin.guestbook.php or (c) auto/glob_new.php; or (2) the lngdefault parameter to auto/ch_lng.php.


Directory traversal vulnerability in the CLAVSetting.CLSetting.1 ActiveX control in CLAVSetting.DLL 1.00.1829 in the CLAVSetting module in CyberLink PowerDVD 7.0 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the CreateNewFile method.


Directory traversal vulnerability in index.php in Firewolf Technologies Synergiser 1.2 RC1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: this can be leveraged to obtain the path by including a local PHP script with a duplicate function declaration.


Directory traversal vulnerability in index.php in the Dance Music module for phpNuke when register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an ACCEPT_FILE array parameter to modules.php.


Directory traversal vulnerability in rxRPC.dll in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allows remote attackers to upload and overwrite arbitrary files via a ..\\ (dot dot backslash) sequence in the destination filename argument to sub-function 8 in the rxrReceiveFileFromServer command.


Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the selskin parameter to index.php. NOTE: this can be leveraged for remote file inclusion by including inc/boxleft.inc and specifying a URL in the xposboxL array parameter.


Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script as available on 20071030 and earlier allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in environments where the system administrator has not followed the vendor recommendations that this product should only be used internally.


** DISPUTED ** Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to the createCertFingerprint function. NOTE: this issue is disputed by CVE because PHP encounters a fatal function-call error on a direct request for payments/ideal_process.php.


Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo (6) emails (7) events (8) fax (9) files (10) groupadm (11) history (12) info (13) log (14) mail (15) messages (16) organizations (17) phones (18) presence (19) projects (20) reports (21) search (22) snf (23) syslog (24) tasks or (25) useradm subdirectory of modules/.


c32web.exe in McMurtrey/Whitaker Cart32 before 6.4 allows remote attackers to read arbitrary files via the ImageName parameter in a GetImage action by appending a NULL byte (%00) sequence followed by an image file extension as demonstrated by a request for a \.txt%00.gif\ file. NOTE: this might be a directory traversal vulnerability.


Directory traversal vulnerability in index.php in easyGB 2.1.1 allows remote attackers to include arbitrary files via the DatabaseType parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple directory traversal vulnerabilities in PHP Content Architect (aka NoAh) 0.9 pre 1.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filepath parameter to (1) css_file.php (2) js_file.php or (3) xml_file.php in noah/modules/nosystem/templates/.


Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1) create arbitrary files via a .. (dot dot) in the username parameter when registering a user account and (2) read arbitrary PHP files via a .. (dot dot) in (a) the topic parameter in a topic action or (b) the username parameter in a viewprofile action.


Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the act parameter possibly involving the news pilih component; as demonstrated by including admin/admin_users.php to bypass a protection mechanism against direct request.


Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: in some environments this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp ftps or ssh2.sftp URL.


Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOptionpagetype parameter to the default URI for modules/news/. NOTE: this can be leveraged by using legitimate product functionality to upload a file that contains the code then including that file.


Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions and Sentinel Keys Server 1.0.3 and possibly earlier versions allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.


Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..\\ (dot dot backslash) sequences in the URL path or (2) remote authenticated users to delete arbitrary files or create arbitrary directories via a ..\\ (dot dot backslash) sequence in the dir parameter to /drive/c/bdusers/USER/.


Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module as demonstrated by reading a password hash in a .dtb file under dati/membri/ or by executing embedded PHP code in images under uploads/avatar/.


Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the global_lang parameter to (1) header_album.php (2) header_blog.php or (3) header_group.php; or (4) admin_header_album.php (5) admin_header_blog.php or (6) admin_header_group.php in admin/.


Multiple directory traversal vulnerabilities in TuMusika Evolution 1.7R5 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) languages_n.php (2) languages_f.php or (3) languages.php in inc/; and (4) allow remote attackers to read arbitrary local files via a .. (dot dot) in the uri parameter to frames/nogui/sc_download.php.


Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php (2) register.php (3) login.php or (4) statistics.php.


Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) the theme_dir parameter to pages/download/default/ops/search.php; or the admin_theme_dir parameter to (3) download.php (4) forum.php or (5) news.php in admin/ops/reports/ops/. NOTE: it was later reported that 1.4.2 beta and earlier are also affected for vector 1.


Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read arbitrary files via a .. (dot dot) in the sFilePath parameter. NOTE: exploitation requires that the product is configured but has zero files in the database.


Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress when register_globals is enabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the wpPATH parameter.


shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal manipulations into a SessionUserLang cookie to public/code/index.php.


Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.


** DISPUTED ** Directory traversal vulnerability in turbulence.php in PHP Turbulence 0.0.1 alpha allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALStcore parameter. NOTE: this vulnerability is disputed by CVE and a reliable third party because a direct request to user/turbulence.php triggers a fatal error before inclusion.


Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme_url parameter to (1) index.php (2) page.php (3) search.php (4) single.php and (5) archives.php.


Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6 when \deployed in an exploded format \ allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via unspecified vectors.


Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 (Ext JS) allows remote attackers to read arbitrary files via a .. (dot dot) in the feed parameter. NOTE: analysis by third party researchers indicates that this issue might be platform dependent.


Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4 and possibly earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to categories.php and other unspecified files.


Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the install element in package.xml 2.0. NOTE: it could be argued that this does not cross privilege boundaries in typical installations since the code being installed could perform the same actions.


Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin_name parameter to template.php in (1) skin/dark/ (2) skin/gold/ or (3) skin/original/ a different vector than CVE-2007-2900. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


** DISPUTED ** Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. (dot dot) in the afilepath parameter. NOTE: a third party has disputed this issue because the a array is populated by a database query before use.


Directory traversal vulnerability in Subversion before 1.4.5 as used by TortoiseSVN before 1.4.5 and possibly other products when run on Windows-based systems allows remote authenticated users to overwrite and create arbitrary files via a ..\\ (dot dot backslash) sequence in the filename as stored in the file repository.


Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the adminlang cookie to admin/functions.php or (2) read arbitrary local files via the img parameter to admin/show_img.php.


Multiple directory traversal vulnerabilities in QuickTalk forum 1.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) sequence in the lang parameter to (1) qtf_checkname.php (2) qtf_j_birth.php or (3) qtf_j_exists.php.


Directory traversal vulnerability in Yet another Bulletin Board (YaBB) 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. (dot dot) in the userlanguage profile setting which sets the userlanguage key of the member hash and is propagated to the language variable in (1) HelpCentre.pl and (2) ICQPager.pl (3) the use_lang variable in Subs.pl and the actlang variable in (4) Post.pl and (5) InstantMessage.pl; as demonstrated by pointing userlanguage to the English folder modifying English/HelpCentre.lng file to contain Perl statements and then invoking the help action in YaBB.pl.


Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) FORUM_LANGUAGE parameter to functions.php or the (2) style parameter to bottom.php.


Directory traversal vulnerability in Ada Image Server (ImgSvr) 0.6.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter to the default URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this is probably a different issue than CVE-2004-2464. NOTE: it was later reported that 0.6.21 and earlier is also affected.


Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an sLanguage cookie which is used to define a value in config/general.php.


** DISPUTED ** Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.1.3 allows remote attackers to include local files via unspecified vectors related to the sourcedir parameter or the actionArray hash. NOTE: CVE and multiple third parties dispute this vulnerability because both sourcedir and actionArray are defined before use.


Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. (dot dot) in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.


Multiple directory traversal vulnerabilities in Maia Mailguard 1.0.2 and earlier might allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) prevlang and (2) super parameters to (a) php/login.php; the (3) charset parameter to (a) php/login.php (b) php/internal-init.php and (c) php/xlogin.php; the (4) lang parameter to (b) php/internal-init.php; and the (5) language parameter to (c) php/xlogin.php.


Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.


Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file a related issue to CVE-2006-2019.


Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALStplname parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by index.php.


Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settingsskin parameter as demonstrated by injecting PHP code into an Apache HTTP Server log file which can then be included via themes/default/.


Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by inc/lang.php.


Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.


Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php) or the (3) action parameter to admin/index.php. NOTE: some of these details are obtained from third party information.


Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by bbcode_ref.php.


Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.3 only checks for the \..\ string which allows remote attackers to overwrite arbitrary files via modified \..\ sequences in a torrent filename as demonstrated by \../\ sequences due to an incomplete fix for CVE-2007-1384.


Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot dot) in the d_private parameter. NOTE: some of these details are obtained from third party information. NOTE: Drake CMS has only a beta version available and the vendor has previously stated \We do not consider security reports valid until the first official release of Drake CMS.\


mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat which allows remote attackers to access protected pages via a crafted prefix JkMount possibly involving double-encoded .. (dot dot) sequences and directory traversal a related issue to CVE-2007-0450.


Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1 when magic_quotes_gpc is disabled allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


** DISPUTED ** Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg_language parameter. NOTE: this issue has been disputed by CVE since the cfg_language variable is configured upon proper product installation.


** DISPUTED ** Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the order parameter. NOTE: another researcher disputes this vulnerability noting that the order variable is not used in any context that allows opening files.


Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories and obtain the installation path via a .. (dot dot) in the d_private parameter. NOTE: Drake CMS has only a beta version available and the vendor has previously stated \We do not consider security reports valid until the first official release of Drake CMS.\


Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skinnn parameter as demonstrated by invoking kg.php with a postek parameter containing PHP code which is injected into a file in the kg directory and then included by sesskglogadmin.php.


Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings and execute arbitrary PHP local files or read arbitrary local templates via a .. (dot dot) in a lang cookie followed by a filename without its .php extension as demonstrated via a request to index.php.


Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a .. (dot dot) in the database filename which is returned by a request to app/update_getfilename.


Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files and upload files to arbitrary locations via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.


Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier and ArsDigita Community Education Solution (ACES) 1.1 allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.


Kiwi CatTools before 3.2.0 beta uses weak encryption (\reversible encoding\) for passwords account names and IP addresses in kiwidb-cattools.kdb which might allow local users to gain sensitive information by decrypting the file. NOTE: this issue could be leveraged with a directory traversal vulnerability for a remote attack vector.


Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via \..\ sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory then referencing that file via the lang parameter to index.php which passes a sanity check in livre_include.php.


include/debug.php in Webfwlog 0.92 and earlier when register_globals is enabled allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be exploited to conduct directory traversal attacks.


Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier when magic_quotes_gpc is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by language.php.


Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject arbitrary PHP code into arbitrary files via \..\ sequences in the subpageName parameter as demonstrated by injecting PHP code into a template file.


Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier when register_globals is enabled and magic_quotes is disabled allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by index.php.


Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors probably \\\..\ sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007 but due to lack of details by Oracle it is unclear which BugID this issue is associated with so the other CVE cannot be determined. Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).


Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. (dot dot) in the chemin parameter to (1) mod_news/index.php or (2) mod_news/goodies.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter as demonstrated by injecting PHP sequences into an Apache HTTP Server log file which is then included by zd_numer.php.


Directory traversal vulnerability in index.php in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web PwP) allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. NOTE: this issue was later reported for 2.5.1.1.


Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte (2) multiple leading slashes (3) Unicode encoding (4) URL-encoded directory traversal or same-directory characters or (5) upper case letters in the domain name.


Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10 when using certain proxy modules (mod_proxy mod_rewrite mod_jk) allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) \/\ (slash) (2) \\\\ (backslash) and (3) URL-encoded backslash (%5C) characters in the URL which are valid separators in Tomcat but not in Apache.


download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathname in the file parameter as demonstrated by config/gallerysetup.php. NOTE: this issue might be resultant from a directory traversal vulnerability.


Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive as demonstrated using the ar program.


Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.


Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.


Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.


Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/.


Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. (dot dot) in the log parameter in a stats action.


Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45 5.5.x before 5.5.29 and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.


The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.


The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.


Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.


Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.


Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.


Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.


Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype as demonstrated by the itemtype parameter in ajax/common.tabs.php.


Multiple

directory

traversal

vulnerabilities

in

BIG-IP

before

allow

local

users

with

the

\Resource

Administrator\

or

\Administrator\

role

to

enumerate

and

delete

arbitrary

files

via

a

(dot

dot)

in

the

name

parameter

to

or

tmui/Control/form.


Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.


Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.


Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \configured block.\ NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.


Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0 3.1 and 3.5.1 McAfee Cloud Single Sign On (MCSSO) before 4.0.1 and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors.


Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type aka Bug ID CSCun91071.


Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter as demonstrated by a request to login/doLogin.


dpkg 1.15.9 on Debian squeeze introduces support for the \C-style encoded filenames\ feature without recognizing that the squeeze patch program lacks this feature which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.


Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.


dpkg 1.15.9 1.16.x before 1.16.14 and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the \C-style encoded filenames\ feature but is supported in environments with noncompliant patch programs which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.


The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root) decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers in addition to JBoss on which this vulnerability is exposed.


Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component and it affects additional products besides Vtiger CRM.


Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23 3.10.x before 3.10.13 3.12.x before 3.12.10 and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.


Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.


Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism and read or modify arbitrary files via a crafted application that uses a relative pathname for a DeviceStorageFile object.


Directory

traversal

vulnerability

in

in

the

implicit-render

implementation

in

Ruby

on

Rails

before

before

and

before

when

certain

route

globbing

configurations

are

enabled

allows

remote

attackers

to

read

arbitrary

files

via

a

crafted

request.


Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier and Security File Manager Trial application 1.0.6 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.


Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.


Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier NeoFiler Free application 5.4.3 and earlier and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.


Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_* (2) LANG or other locale environment variable.


Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3 tetra filer free application 2.3.1 and earlier for Android 4.0.3 tetra filer application 1.5.1 and earlier for Android before 4.0.3 and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.


Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5 140NOC78x Exec before 1.62 140NOE77x Exec before 6.2 BMXNOC0401 before 2.05 BMXNOE0100 before 2.9 BMXNOE0110x Exec before 6.0 TSXETC101 Exec before 2.04 TSXETY4103x Exec before 5.7 TSXETY5103x Exec before 5.9 TSXP57x ETYPort Exec before 5.7 and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.


The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.


Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData (2) the download parameter in a download action to servlet/MGConfigData (3) the download parameter in a port_svc action to servlet/MGConfigData (4) the file parameter in a getfile action to servlet/Installer or (5) the binfile parameter to servlet/MGConfigData.


Directory traversal vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0 through 7.0.0.2 CF27 and 8.0 before 8.0.0.1 CF06 allows remote attackers to read arbitrary files via a crafted URL.


Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup parameter to system_firmware_restorefullbackup.php.


The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence as demonstrated by a %2f separator.