ByteOS

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md	x_refsource_CONFIRM x_transferred
https://github.com/realtimeprojects/quixplorer	x_refsource_MISC x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/89059	vdb-entry x_refsource_XF x_transferred
https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436	x_refsource_CONFIRM x_transferred
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt	x_refsource_MISC x_transferred
http://secunia.com/advisories/55725	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://github.com/realtimeprojects/quixplorer

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/89059

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt

Resource:

x_refsource_MISC

x_transferred

cpe:2.3:a:quixplorer:quixplorer:*:*:*:*:*:*:*:*

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:26 Oct, 2014 | 17:55

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.8	HIGH	AV:N/AC:L/Au:N/C:C/I:N/A:N

Type: Primary

Version: 2.0

Base score: 7.8

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:N/A:N

CPE Matches

quixplorer>>quixplorer>>Versions up to 2.5.4(inclusive)

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	nvd@nist.gov

CWE ID: CWE-22

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/55725	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/89059	cve@mitre.org	N/A
https://github.com/realtimeprojects/quixplorer	cve@mitre.org	N/A
https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md	cve@mitre.org	N/A
https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436	cve@mitre.org	Exploit
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt	cve@mitre.org	Exploit
http://secunia.com/advisories/55725	af854a3a-2127-422b-91ae-364da2661108	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/89059	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/realtimeprojects/quixplorer	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436	af854a3a-2127-422b-91ae-364da2661108	Exploit
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt	af854a3a-2127-422b-91ae-364da2661108	Exploit

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/89059

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt

Source: cve@mitre.org

Resource:

Exploit

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/89059

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Hyperlink: https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Similar CVEs

115Records found

CVE-2018-14918

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-73.14% / 98.73%

7 Day CHG~0.00%

Published-28 Jun, 2019 | 17:01

Updated-05 Aug, 2024 | 09:46

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.

Vendor-loytec n/a

Product-lgate-902 lgate-902_firmware n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2016-1525

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-8.6||HIGH

EPSS-83.58% / 99.24%

7 Day CHG~0.00%

Published-13 Feb, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.

Vendor-n/a NETGEAR, Inc.

Product-prosafe_network_management_software_300 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2016-2389

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-80.79% / 99.11%

7 Day CHG~0.00%

Published-16 Feb, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.

Vendor-n/a SAP SE

Product-netweaver n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2016-1429

Matching Score-4

Assigner-Cisco Systems, Inc.

Product-rv180_vpn_router rv180_vpn_router_firmware rv180w_wireless-n_multifunction_vpn_router_firmware rv180w_wireless-n_multifunction_vpn_router n/a

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-7.5||HIGH

EPSS-0.96% / 75.49%

7 Day CHG~0.00%

Published-08 Aug, 2016 | 00:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuz43023.

Vendor-n/a Cisco Systems, Inc.

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2018-12909

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-87.46% / 99.42%

7 Day CHG~0.00%

Published-27 Jun, 2018 | 16:00

Updated-17 Sep, 2024 | 00:42

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment.

Vendor-webgrind_project n/a

Product-webgrind n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2018-11789

Matching Score-4

Assigner-Apache Software Foundation

Matching Score-4

Assigner-Apache Software Foundation

CVSS Score-7.5||HIGH

EPSS-2.21% / 83.79%

7 Day CHG~0.00%

Published-18 Mar, 2019 | 14:15

Updated-05 Aug, 2024 | 08:17

When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd.

Vendor-n/a The Apache Software Foundation

Product-heron Apache Incubator Heron

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2018-12314

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.99% / 75.97%

7 Day CHG~0.00%

Published-04 Dec, 2018 | 17:00

Updated-05 Aug, 2024 | 08:30

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters.

Vendor-n/a ASUSTOR Inc.

Product-as602t data_master n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2017-9833

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-90.75% / 99.61%

7 Day CHG~0.00%

Published-24 Jun, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.

Vendor-boa n/a

Product-boa n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2016-1145

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-7.5||HIGH

EPSS-0.43% / 61.70%

7 Day CHG~0.00%

Published-30 Jan, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote attackers to read arbitrary files via unspecified vectors.

Vendor-n/a NEC Corporation

Product-expresscluster_x n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-7601

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-52.58% / 97.85%

7 Day CHG~0.00%

Published-29 Sep, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command.

Vendor-pcman\'s_ftp_server_project n/a

Product-pcman\'s_ftp_server n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2019-10265

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.72% / 71.65%

7 Day CHG~0.00%

Published-26 Jul, 2019 | 20:49

Updated-04 Aug, 2024 | 22:17

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.

Vendor-ahsay n/a

Product-cloud_backup_suite n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-5472

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.93% / 75.12%

7 Day CHG~0.00%

Published-15 Sep, 2015 | 18:00

Updated-12 Apr, 2025 | 10:46

Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.

Vendor-ibs_mappro_project n/a

Product-ibs_mappro n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-4988

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-8.6||HIGH

EPSS-0.49% / 64.69%

7 Day CHG~0.00%

Published-18 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.

Vendor-n/a IBM Corporation

Product-tealeaf_customer_experience n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-4546

Matching Score-4

Assigner-Dell

Matching Score-4

Assigner-Dell

CVSS Score-7.8||HIGH

EPSS-3.40% / 86.92%

7 Day CHG~0.00%

Published-02 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in EMC RSA OneStep 6.9 before build 559, as used in RSA Certificate Manager and RSA Registration Manager through 6.9 build 558 and other products, allows remote attackers to read arbitrary files via a crafted KCSOSC_ERROR_PAGE parameter.

Vendor-n/a ELAN Microelectronics Corporation

Product-rsa_onestep rsa_certificate_manager n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-2860

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-7.8||HIGH

EPSS-0.46% / 63.30%

7 Day CHG~0.00%

Published-23 Jun, 2015 | 16:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in Avigilon Control Center (ACC) 4 before 4.12.0.54 and 5 before 5.4.2.22 allows remote attackers to read arbitrary files via a crafted help/ URL.

Vendor-avigilon n/a

Product-avigilon_control_center n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-1503

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-91.34% / 99.65%

7 Day CHG~0.00%

Published-08 May, 2018 | 20:00

Updated-06 Aug, 2024 | 04:47

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.

Vendor-icewarp n/a

Product-mail_server n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2015-0666

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-7.8||HIGH

EPSS-68.97% / 98.57%

7 Day CHG~0.00%

Published-03 Apr, 2015 | 10:00

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-04-15||Apply updates per vendor instructions.

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.

Vendor-n/a Cisco Systems, Inc.

Product-prime_data_center_network_manager n/a Prime Data Center Network Manager (DCNM)

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2018-7539

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-19.12% / 95.11%

7 Day CHG~0.00%

Published-17 Apr, 2018 | 20:00

Updated-05 Aug, 2024 | 06:31

On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.

Vendor-appeartv n/a

Product-xc5000 xc5100_firmware xc5000_firmware xc5100 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-8742

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-8.10% / 91.79%

7 Day CHG~0.00%

Published-27 Jan, 2020 | 17:29

Updated-06 Aug, 2024 | 13:26

Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to read arbitrary files via unspecified vectors.

Vendor-n/a Lexmark International, Inc.

Product-markvision_enterprise n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-14864

Matching Score-4

Assigner-Oracle

Product-business_intelligence Business Intelligence Enterprise Edition Intelligence Enterprise Edition

Matching Score-4

Assigner-Oracle

CVSS Score-7.5||HIGH

EPSS-94.01% / 99.88%

7 Day CHG~0.00%

Published-21 Oct, 2020 | 14:04

Updated-30 Jul, 2025 | 01:45

Known KEV||Action Due Date - 2022-07-18||Apply updates per vendor instructions.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vendor-Oracle Corporation

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-6154

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-7.8||HIGH

EPSS-0.31% / 53.37%

7 Day CHG~0.00%

Published-13 Feb, 2015 | 02:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in IBM Optim Performance Manager for DB2 4.1.0.1 through 4.1.1 on Linux, UNIX, and Windows and IBM InfoSphere Optim Performance Manager for DB2 5.1 through 5.3.1 on Linux, UNIX, and Windows allows remote attackers to access arbitrary files via a .. (dot dot) in a URL.

Vendor-n/a IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows linux_kernel optim_performance_manager n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-5359

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.40% / 60.01%

7 Day CHG~0.00%

Published-16 Dec, 2014 | 18:00

Updated-12 Apr, 2025 | 10:46

Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa.

Vendor-safenet-inc n/a

Product-safenet_authentication_service_outlook_web_access_agent n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-27467

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-79.83% / 99.06%

7 Day CHG~0.00%

Published-22 Feb, 2022 | 20:59

Updated-04 Aug, 2024 | 16:18

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

Vendor-processwire n/a

Product-processwire n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-2962

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-7.8||HIGH

EPSS-90.05% / 99.56%

7 Day CHG~0.00%

Published-19 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.

Vendor-n/a Belkin International, Inc.

Product-n150_f9k1009 n150_f9k1009_firmware n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-0115

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-0.66% / 70.27%

7 Day CHG~0.00%

Published-30 Oct, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

Vendor-n/a The Apache Software Foundation

Product-storm n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2014-0358

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-7.8||HIGH

EPSS-14.24% / 94.13%

7 Day CHG~0.00%

Published-15 Apr, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.

Vendor-xangati n/a

Product-xangati_software_release xangati_xnr n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6334

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.00% / 82.92%

7 Day CHG~0.00%

Published-27 Feb, 2009 | 17:00

Updated-07 Aug, 2024 | 11:27

Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

Vendor-emetrix n/a

Product-extract_website n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-5997

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.72% / 85.35%

7 Day CHG~0.00%

Published-28 Jan, 2009 | 15:00

Updated-07 Aug, 2024 | 11:13

Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform (OCP) 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter.

Vendor-ocp2 n/a

Product-omnicom_content_platform n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6183

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.11% / 83.38%

7 Day CHG~0.00%

Published-19 Feb, 2009 | 18:00

Updated-07 Aug, 2024 | 11:20

Multiple directory traversal vulnerabilities in index.php in My PHP Indexer 1.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) d and (2) f parameters.

Vendor-myphpindexer n/a

Product-my_php_indexer n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6195

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-1.60% / 80.93%

7 Day CHG~0.00%

Published-20 Feb, 2009 | 00:00

Updated-07 Aug, 2024 | 11:20

Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643.

Vendor-landesk n/a

Product-landesk_management_suite n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6335

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.00% / 82.92%

7 Day CHG~0.00%

Published-27 Feb, 2009 | 17:00

Updated-07 Aug, 2024 | 11:27

Directory traversal vulnerability in download.php in eMetrix Online Keyword Research Tool allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

Vendor-emetrix n/a

Product-online_keyword_research_tool n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6630

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.33% / 55.57%

7 Day CHG~0.00%

Published-07 Apr, 2009 | 10:00

Updated-07 Aug, 2024 | 11:34

Directory traversal vulnerability in the wt_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine directory structure via unspecified vectors.

Vendor-n/a TYPO3 Association

Product-typo3 wt_gallery n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6288

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.00% / 82.92%

7 Day CHG~0.00%

Published-25 Feb, 2009 | 23:00

Updated-07 Aug, 2024 | 11:27

Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

Vendor-interface-medien n/a

Product-ibase n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-5645

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.24% / 47.60%

7 Day CHG~0.00%

Published-17 Dec, 2008 | 18:00

Updated-07 Aug, 2024 | 11:04

Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.

Vendor-orb_networks n/a

Product-orb n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-5116

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.72% / 71.64%

7 Day CHG~0.00%

Published-18 Nov, 2008 | 00:00

Updated-07 Aug, 2024 | 10:40

Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.

Vendor-n/a Sun Microsystems (Oracle Corporation)

Product-java_system_identity_manager n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-5315

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.15% / 36.12%

7 Day CHG~0.00%

Published-03 Dec, 2008 | 17:00

Updated-07 Aug, 2024 | 10:49

Directory traversal vulnerability in the web interface in Apple iPhone Configuration Web Utility 1.0 on Windows allows remote attackers to read arbitrary files via unspecified vectors.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-windows iphone_configuration_web_utility n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4243

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-14.29% / 94.14%

7 Day CHG~0.00%

Published-25 Sep, 2008 | 19:00

Updated-07 Aug, 2024 | 10:08

Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tournament 3 (UT3) 1.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Vendor-epic_games n/a

Product-unreal_tournament_3 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4421

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-6.11% / 90.41%

7 Day CHG~0.00%

Published-07 Oct, 2008 | 18:27

Updated-07 Aug, 2024 | 10:17

Directory traversal vulnerability in MetaGauge 1.0.0.17, and probably other versions before 1.0.3.38, allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the URL.

Vendor-hammer-software n/a

Product-metagauge n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4155

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-1.75% / 81.78%

7 Day CHG~0.00%

Published-19 Sep, 2008 | 23:00

Updated-07 Aug, 2024 | 10:08

Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list directories via a .. (dot dot) in the (1) module or (2) action parameter in (a) www/index.php; the (3) module, (4) ss_module, or (5) ss_action parameter in (b) modules/Module/index.php or (c) modules/Themes/index.php; or the (6) module parameter in (d) inc/vmenu.php.

Vendor-easybrik n/a

Product-easysite n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4419

Matching Score-4

Assigner-MITRE Corporation

Product-9200c_digital_sender color_laserjet_9500mfp laserjet_4345mfp laserjet_9050 laserjet_4350 laserjet_2420 color_laserjet_4370mfp laserjet_9040mfp laserjet_9040 laserjet_2430 laserjet_2410 laserjet_9050mfp laserjet_4250 n/a

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.66% / 70.17%

7 Day CHG~0.00%

Published-05 Feb, 2009 | 00:00

Updated-07 Aug, 2024 | 10:17

Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410, LaserJet 2420, and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.

Vendor-n/a HP Inc.

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4040

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.26% / 48.76%

7 Day CHG~0.00%

Published-11 Sep, 2008 | 14:00

Updated-07 Aug, 2024 | 10:00

Directory traversal vulnerability in the Kyocera Command Center in Kyocera FS-118MFP allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Vendor-kyocera_mita n/a

Product-fs_118mfp n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-25216

Matching Score-4

Matching Score-4

CVSS Score-7.5||HIGH

EPSS-82.78% / 99.20%

7 Day CHG~0.00%

Published-11 Mar, 2022 | 17:54

Updated-03 Aug, 2024 | 04:36

An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access, by means of an HTTP GET request to http://<IP_ADDRESS>:32080/download/<URL_ENCODED_PATH>.

Vendor-dvdfab n/a

Product-12_player playerfab DVDFab 12 Player / PlayerFab

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-4361

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-1.75% / 81.78%

7 Day CHG~0.00%

Published-30 Sep, 2008 | 21:00

Updated-07 Aug, 2024 | 10:17

Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. (dot dot) in the path parameter to the default URI.

Vendor-powerportal n/a

Product-powerportal n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-1169

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-2.42% / 84.49%

7 Day CHG~0.00%

Published-05 Mar, 2008 | 23:00

Updated-07 Aug, 2024 | 08:08

Directory traversal vulnerability in the embedded HTTP server in SCI Photo Chat Server 3.4.9 and earlier allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot forward slash) in the GET command.

Vendor-simm-comm n/a

Product-sci_photo_chat n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-24219

Matching Score-4

Assigner-MITRE Corporation

Product-use265-1lw uhce264-4p8 uhe264-16l-3u uhe264-1ws-mini uhe264-4 use264-1wb-l uhe265-1s-4k uhe264-1l-4k uhe264-1w-mini use264-1l uhe265-1w-mini uhe265-4s uhce264-1s uce264-1-mini use265-1w-mini use265-1l-mini uve264-1l uce264-1wb-mini uce264-8-1u uhe265-1lw uhe264-1wb-mini uhe265-1wb-mini uaioe265-1u uhe265-1wbs-mini uhe265-1-mini use265-1wb-l uhe265-16l-3u uhe264-1l uhae265-4-1u uhe265-1w-4k uaioe264-1u uhe264-1-4k uhe264-1wbs-2b uhe265-8s-1u use265-1-mini uhe265-8-1u uve265-1w use264-8-1u uhe264-8-1u uhe264-2-1u use265-16l-3u uhe264-1wb-4g uhe264-1s-mini uhe265-1wb-4g use264-1l-mini uhe265-1l uhe264-1s iptv\/h.264_video_encoder_firmware uhe265-1s-mini use264-4l-1u use265-1l-1u uhe264-4l-1u use265-1wb-4g uhe264-1wbs-mini use265-4l-1u use265-4-1u use265-1l uhe265-4s-1u uhe265-8l-3u uhe265-4-1u uve265-1 uhae264-16 uhe264-1lw uhae265-1wb-mini use265-1wb-mini uhae265-1-mini uhe265-1-4k use265-8-1u uhe265-4 uve264-1lw use265-1-1u uhe265-1 uhe265-2-1u uhce264-1p2-1u uhe264-8 use264-16-3u use264-1lw uhce264-1ws uhe264-8s-2u uhe265-16-3u uhce264-1p2 uhe264-4-1u uhe264-16s-2u uhce264-1w uhse265-1u uhce264-1 uhce264-16p32 uhe265-1w use265-2-1u use264-1l-1u iptv\/h.265_video_encoder_firmware uhe265-1-1u uhe264-8l-3u uce264-4-1u uhe264-16 n/a

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-16.91% / 94.70%

7 Day CHG-6.81%

Published-06 Oct, 2020 | 13:16

Updated-04 Aug, 2024 | 15:12

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with the cleartext administrative password.

Vendor-szuray n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2021-20123

Matching Score-4

Matching Score-4

CVSS Score-7.5||HIGH

EPSS-93.18% / 99.79%

7 Day CHG~0.00%

Published-13 Oct, 2021 | 15:47

Updated-30 Jul, 2025 | 01:37

Known KEV||Action Due Date - 2024-09-24||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Vendor-n/a DrayTek Corp.

Product-vigorconnect Draytek VigorConnect vigorconnect VigorConnect

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-24136

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.6||HIGH

EPSS-1.28% / 78.71%

7 Day CHG~0.00%

Published-07 Apr, 2021 | 15:00

Updated-04 Aug, 2024 | 15:05

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.

Vendor-wcms n/a

Product-wcms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2007-3874

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.45% / 62.76%

7 Day CHG~0.00%

Published-06 Nov, 2007 | 19:00

Updated-07 Aug, 2024 | 14:37

Directory traversal vulnerability in the tftp/mftp daemon in the PXE server component (pxemtftp.exe) in Symantec Altiris Deployment Solution 6.x before 6.8.380.0 allows remote attackers to read arbitrary files via unspecified vectors.

Vendor-altiris n/a

Product-deployment_solution n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2012-4958

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-7.8||HIGH

EPSS-73.56% / 98.75%

7 Day CHG~0.00%

Published-18 Nov, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.

Vendor-n/a Novell

Product-file_reporter n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-15012

Matching Score-4

Assigner-MITRE Corporation