CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2014(Directory Traversal)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-2976 1 Dir. Trav. 2014-04-23 2014-04-23
0.0
None ??? ??? ??? ??? ??? ???
Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 18081.
2 CVE-2014-2864 22 Dir. Trav. 2014-04-15 2014-04-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
3 CVE-2014-2863 22 Dir. Trav. 2014-04-15 2014-04-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
4 CVE-2014-2858 22 Dir. Trav. +Info 2014-04-15 2014-04-22
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.
5 CVE-2014-2732 22 Dir. Trav. 2014-04-19 2014-04-21
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80.
6 CVE-2014-2588 22 1 Dir. Trav. 2014-03-24 2014-04-01
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter.
7 CVE-2014-2583 22 Dir. Trav. Bypass 2014-04-10 2014-04-11
5.8
None Remote Medium Not required Partial Partial None
Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function.
8 CVE-2014-2536 22 Dir. Trav. 2014-03-18 2014-04-01
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors.
9 CVE-2014-2535 22 Dir. Trav. 2014-03-18 2014-04-01
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port.
10 CVE-2014-2324 22 Dir. Trav. 2014-03-14 2014-04-19
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
11 CVE-2014-2314 22 Dir. Trav. 2014-03-09 2014-03-10
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.
12 CVE-2014-2313 22 Dir. Trav. 2014-03-09 2014-03-10
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.
13 CVE-2014-2210 22 DoS Exec Code Dir. Trav. Bypass +Info 2014-04-04 2014-04-04
7.5
None Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in CA ERwin Web Portal 9.5 allow remote attackers to obtain sensitive information, bypass intended access restrictions, cause a denial of service, or possibly execute arbitrary code via unspecified vectors.
14 CVE-2014-2145 22 Dir. Trav. 2014-04-05 2014-04-07
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071.
15 CVE-2014-2059 22 Dir. Trav. 2014-02-28 2014-03-04
6.5
None Remote Low Single system Partial Partial Partial
Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
16 CVE-2014-1975 22 Dir. Trav. 2014-03-18 2014-03-18
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
17 CVE-2014-1974 22 Dir. Trav. 2014-04-19 2014-04-24
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in the LYSESOFT AndExplorer application before 20140403 and AndExplorerPro application before 20140405 for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
18 CVE-2014-1970 22 Dir. Trav. 2014-03-20 2014-03-20
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the ES File Explorer File Manager application before 3.0.4 for Android allows remote attackers to overwrite or create arbitrary files via unspecified vectors.
19 CVE-2014-1969 22 Dir. Trav. 2014-04-11 2014-04-14
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the apps4u@android SD Card Manager application before 20140224 for Android allows attackers to overwrite or create arbitrary files via a crafted filename.
20 CVE-2014-1907 22 Dir. Trav. 2014-03-06 2014-03-07
6.4
None Remote Low Not required Partial None Partial
Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.
21 CVE-2014-1833 22 Dir. Trav. 2014-02-05 2014-02-21
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
22 CVE-2014-1715 22 Dir. Trav. 2014-03-16 2014-04-01
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors.
23 CVE-2014-1707 22 Dir. Trav. 2014-03-16 2014-03-25
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors.
24 CVE-2014-1698 22 Dir. Trav. 2014-02-06 2014-02-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
25 CVE-2014-1507 22 Dir. Trav. Bypass 2014-03-19 2014-03-19
9.3
None Remote Medium Not required Complete Complete Complete
Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.
26 CVE-2014-1506 22 DoS Dir. Trav. 2014-03-19 2014-04-01
6.4
None Remote Low Not required Partial None Partial
Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments.
27 CVE-2014-0830 22 Dir. Trav. 2014-02-01 2014-02-03
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote authenticated users to read arbitrary files via a modified pathname.
28 CVE-2014-0820 22 Dir. Trav. 2014-02-26 2014-03-10
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to read arbitrary files via unspecified vectors.
29 CVE-2014-0809 22 Dir. Trav. 2014-01-24 2014-02-21
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
30 CVE-2014-0805 22 Dir. Trav. 2014-01-12 2014-01-13
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
31 CVE-2014-0804 22 Dir. Trav. 2014-01-12 2014-01-13
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
32 CVE-2014-0803 22 Dir. Trav. 2014-01-12 2014-01-13
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the tetra filer application 2.3.1 and earlier for Android 4.0.3, tetra filer free application 2.3.1 and earlier for Android 4.0.3, tetra filer application 1.5.1 and earlier for Android before 4.0.3, and tetra filer free application 1.5.1 and earlier for Android before 4.0.3 allows attackers to overwrite or create arbitrary files via unspecified vectors.
33 CVE-2014-0802 22 Dir. Trav. 2014-01-12 2014-01-13
5.8
None Remote Medium Not required None Partial Partial
Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors.
34 CVE-2014-0751 22 Exec Code Dir. Trav. 2014-01-25 2014-02-21
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623.
35 CVE-2014-0750 22 Exec Code Dir. Trav. 2014-01-25 2014-02-21
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
36 CVE-2014-0666 22 Exec Code Dir. Trav. 2014-01-16 2014-01-23
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.
37 CVE-2014-0632 22 Exec Code Dir. Trav. 2014-04-01 2014-04-01
9.0
None Remote Low Single system Complete Complete Complete
Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
38 CVE-2014-0358 22 Dir. Trav. 2014-04-15 2014-04-15
7.8
None Remote Low Not required Complete None None
Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.
39 CVE-2014-0053 264 Dir. Trav. +Info 2014-04-15 2014-04-22
5.0
None Remote Low Not required Partial None None
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
40 CVE-2013-7361 22 Dir. Trav. 2014-04-10 2014-04-11
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.
41 CVE-2013-7300 22 Dir. Trav. 2014-02-01 2014-02-03
5.0
None Remote Low Not required Partial None None
Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.
42 CVE-2013-7240 22 Dir. Trav. 2014-01-03 2014-02-25
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter.
43 CVE-2013-7174 22 Dir. Trav. 2014-01-09 2014-02-21
7.8
None Remote Low Not required Complete None None
Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter.
44 CVE-2013-7138 22 Dir. Trav. 2014-01-09 2014-01-10
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in lib/functions/d-load.php in Horizon Quick Content Management System (QCMS) 4.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
45 CVE-2013-7097 22 Dir. Trav. 2014-01-08 2014-02-25
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in 7 Media Web Solutions eduTrac before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the showmask parameter to installer/overview.php.
46 CVE-2013-6768 22 Dir. Trav. 2014-03-31 2014-03-31
5.0
None Remote Low Not required None Partial None
Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse app_process program via a crafted PATH environment variable for a /system/xbin/su process.
47 CVE-2013-6720 22 1 Dir. Trav. Bypass 2014-03-06 2014-04-01
5.5
None Remote Low Single system Partial Partial None
Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter, as demonstrated using a crafted request for a customer-support file, as demonstrated by a log file.
48 CVE-2013-6652 22 Dir. Trav. Bypass 2014-02-23 2014-02-24
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks for .. (dot dot) sequences or (2) lack of use of the \\?\ protection mechanism.
49 CVE-2013-6304 22 Dir. Trav. Bypass 2014-03-06 2014-03-07
4.0
None Remote Low Single system Partial None None
Multiple directory traversal vulnerabilities in Algo Risk Application (ARA) 2.4.0.1 through 4.9.1 in IBM Algo One allow remote authenticated users to bypass intended access restrictions via a crafted pathname for a (1) configuration or (2) JAR file.
50 CVE-2013-6303 22 Dir. Trav. 2014-03-05 2014-03-07
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to read arbitrary files via unspecified vectors.
Total number of vulnerabilities : 71   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.