CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (Directory Traversal)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-6394 22 Dir. Trav. 2014-10-08 2014-10-09
7.5
None Remote Low Not required Partial Partial Partial
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
2 CVE-2014-6308 Dir. Trav. 2014-10-20 2014-10-20
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
3 CVE-2014-5465 22 1 Dir. Trav. 2014-09-03 2014-09-03
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
4 CVE-2014-5393 22 Dir. Trav. 2014-09-11 2014-09-11
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote authenticated users with the info permission to read arbitrary files in the webroot via unspecified vectors.
5 CVE-2014-5368 22 Dir. Trav. 2014-08-22 2014-08-27
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
6 CVE-2014-5350 22 Dir. Trav. 2014-08-19 2014-08-20
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server.
7 CVE-2014-5319 22 Dir. Trav. 2014-09-26 2014-10-14
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in the S-Link SLFileManager application 1.2.5 and earlier for Android allows remote attackers to write to files via unspecified vectors.
8 CVE-2014-5197 22 Dir. Trav. 2014-08-12 2014-08-13
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids.
9 CVE-2014-5187 22 Dir. Trav. 2014-08-06 2014-08-07
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.
10 CVE-2014-5181 22 Dir. Trav. 2014-08-06 2014-08-07
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.
11 CVE-2014-5160 22 Dir. Trav. 2014-08-01 2014-08-01
6.4
None Remote Low Not required None Partial Partial
** DISPUTED ** Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. NOTE: the vendor reportedly asserts that this behavior is "by design."
12 CVE-2014-5115 22 1 Dir. Trav. 2014-07-29 2014-08-27
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname in the phpfile parameter to index.php.
13 CVE-2014-5111 22 Dir. Trav. 2014-07-28 2014-07-29
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.
14 CVE-2014-5006 1 Exec Code Dir. Trav. 2014-10-21 2014-10-21
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
15 CVE-2014-5005 1 Exec Code Dir. Trav. 2014-10-21 2014-10-21
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
16 CVE-2014-4941 22 Dir. Trav. 2014-07-11 2014-07-14
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.
17 CVE-2014-4940 22 Dir. Trav. 2014-07-11 2014-07-14
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
18 CVE-2014-4937 22 Dir. Trav. 2014-07-11 2014-07-14
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
19 CVE-2014-4929 22 Dir. Trav. 2014-08-20 2014-08-21
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.
20 CVE-2014-4910 22 Dir. Trav. 2014-07-24 2014-07-25
4.6
None Local Low Not required Partial Partial Partial
Directory traversal vulnerability in tools/backlight_helper.c in X.Org xf86-video-intel 2.99.911 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the interface name.
21 CVE-2014-4690 22 Dir. Trav. 2014-07-02 2014-07-02
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup parameter to system_firmware_restorefullbackup.php.
22 CVE-2014-4689 22 Dir. Trav. 2014-07-02 2014-07-02
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.
23 CVE-2014-4507 22 Dir. Trav. 2014-06-20 2014-06-23
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.
24 CVE-2014-4384 22 Dir. Trav. 2014-09-18 2014-09-18
1.9
None Local Medium Not required None Partial None
Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local users to install unverified apps by triggering code-signature validation of an unintended bundle.
25 CVE-2014-4306 22 Dir. Trav. 2014-06-18 2014-06-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. (dot dot) in the logfile parameter in a download action.
26 CVE-2014-3975 22 1 Dir. Trav. 2014-06-05 2014-06-06
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
27 CVE-2014-3914 22 1 Exec Code Dir. Trav. 2014-08-07 2014-08-07
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.
28 CVE-2014-3865 22 Dir. Trav. 2014-05-30 2014-06-24
6.4
None Remote Low Not required None Partial Partial
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.
29 CVE-2014-3864 22 Dir. Trav. 2014-05-30 2014-06-24
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.
30 CVE-2014-3855 22 Dir. Trav. 2014-08-07 2014-08-07
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in download.py in Pyplate 0.08 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
31 CVE-2014-3806 22 1 Dir. Trav. 2014-05-21 2014-05-22
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the xml_path parameter.
32 CVE-2014-3777 22 Dir. Trav. 2014-07-16 2014-07-16
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Reportico PHP Report Designer before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the xmlin parameter.
33 CVE-2014-3664 22 Dir. Trav. 2014-10-15 2014-10-21
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in CloudBees Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
34 CVE-2014-3460 22 Exec Code Dir. Trav. 2014-05-20 2014-06-21
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted pathname.
35 CVE-2014-3340 22 Dir. Trav. 2014-08-20 2014-08-20
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCuo16166.
36 CVE-2014-3323 22 Dir. Trav. 2014-07-17 2014-08-01
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262.
37 CVE-2014-3319 22 Dir. Trav. 2014-07-14 2014-07-18
6.8
None Remote Low Single system Complete None None
Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.
38 CVE-2014-3318 20 Dir. Trav. 2014-07-10 2014-07-18
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.
39 CVE-2014-3317 22 Dir. Trav. 2014-07-14 2014-07-18
5.5
None Remote Low Single system None Partial Partial
Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.
40 CVE-2014-3227 22 Dir. Trav. 2014-05-30 2014-06-24
6.4
None Remote Low Not required None Partial Partial
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
41 CVE-2014-3225 22 1 Dir. Trav. 2014-05-13 2014-05-16
4.0
None Remote Low Single system Partial None None
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
42 CVE-2014-3127 22 Dir. Trav. 2014-05-13 2014-06-05
7.1
None Remote High Not required None Complete Complete
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.
43 CVE-2014-2976 22 1 Dir. Trav. 2014-04-23 2014-05-16
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081.
44 CVE-2014-2962 22 Dir. Trav. 2014-06-19 2014-06-19
7.8
None Remote Low Not required Complete None None
Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
45 CVE-2014-2933 22 Dir. Trav. 2014-05-08 2014-07-01
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname.
46 CVE-2014-2864 22 Dir. Trav. 2014-04-15 2014-04-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
47 CVE-2014-2863 22 Dir. Trav. 2014-04-15 2014-04-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
48 CVE-2014-2858 22 Dir. Trav. +Info 2014-04-15 2014-04-22
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.
49 CVE-2014-2846 22 Exec Code Dir. Trav. 2014-04-28 2014-04-29
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin.
50 CVE-2014-2732 22 Dir. Trav. 2014-04-19 2014-04-21
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80.
Total number of vulnerabilities : 2745   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.