ByteOS Network

Vulnerability Details :

CVE-2017-5143

Assigner Org ID-7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At-13 Feb, 2017 | 21:00

Updated At-05 Aug, 2024 | 14:55

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:icscert

Assigner Org ID:7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At:13 Feb, 2017 | 21:00

Updated At:05 Aug, 2024 | 14:55

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

Honeywell XL Web II Controller

Versions

Affected

Honeywell XL Web II Controller

Problem Types

Type	CWE ID	Description
text	N/A	Honeywell XL Web II Controller directory traversal

Type: text

CWE ID: N/A

Description: Honeywell XL Web II Controller directory traversal

References

Hyperlink	Resource
http://www.securityfocus.com/bid/95971	vdb-entry x_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01	x_refsource_MISC

Hyperlink: http://www.securityfocus.com/bid/95971

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.securityfocus.com/bid/95971	vdb-entry x_refsource_BID x_transferred
https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01	x_refsource_MISC x_transferred

Hyperlink: http://www.securityfocus.com/bid/95971

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:ics-cert@hq.dhs.gov

Published At:13 Feb, 2017 | 21:59

Updated At:20 Apr, 2025 | 01:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Honeywell International Inc.

>>xl_web_ii_controller>>xlwebexe-1-02-08

cpe:2.3:o:honeywell:xl_web_ii_controller:xlwebexe-1-02-08:*:*:*:*:*:*:*

Honeywell International Inc.

>>xl_web_ii_controller>>xlwebexe-2-01-00

cpe:2.3:o:honeywell:xl_web_ii_controller:xlwebexe-2-01-00:*:*:*:*:*:*:*

Honeywell International Inc.

>>xl_web_ii_controller>>-

cpe:2.3:h:honeywell:xl_web_ii_controller:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	nvd@nist.gov

CWE ID: CWE-22

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/95971	ics-cert@hq.dhs.gov	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01	ics-cert@hq.dhs.gov	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/95971	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource

Hyperlink: http://www.securityfocus.com/bid/95971

Source: ics-cert@hq.dhs.gov

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01

Source: ics-cert@hq.dhs.gov

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://www.securityfocus.com/bid/95971

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

US Government Resource

Similar CVEs

563Records found

CVE-2009-4740

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.13% / 33.22%

7 Day CHG~0.00%

Published-26 Mar, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Directory traversal vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 has unspecified impact and remote attack vectors.

Vendor-n/a TYPO3 Association

Product-ws_ecard typo3 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-4626

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.95% / 75.42%

7 Day CHG~0.00%

Published-18 Jan, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the conf[lang] parameter.

Vendor-phpnagios n/a

Product-phpnagios n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3825

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-28 Oct, 2009 | 10:00

Updated-07 Aug, 2024 | 06:38

Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) p parameter to show.php and the (2) Template parameter to admin/pages/SiteNew.php.

Vendor-thomas_graber n/a

Product-gencms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-4261

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.68% / 70.69%

7 Day CHG~0.00%

Published-21 Dec, 2009 | 16:00

Updated-07 Aug, 2024 | 06:54

Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."

Vendor-roman_marxer n/a

Product-ganeti n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3887

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.34% / 55.63%

7 Day CHG~0.00%

Published-29 Oct, 2019 | 12:37

Updated-07 Aug, 2024 | 06:45

ytnef has directory traversal

Vendor-ytnef_project ytnef

Product-ytnef ytnef

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-4056

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.30% / 78.88%

7 Day CHG~0.00%

Published-24 Nov, 2009 | 02:00

Updated-16 Sep, 2024 | 20:36

Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the popup parameter.

Vendor-betsy n/a

Product-betsy_cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-4427

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-18.92% / 95.08%

7 Day CHG~0.00%

Published-28 Dec, 2009 | 18:27

Updated-07 Aug, 2024 | 07:01

Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.

Vendor-phpldapadmin_project n/a

Product-phpldapadmin n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2658

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.96% / 75.57%

7 Day CHG~0.00%

Published-04 Aug, 2009 | 16:13

Updated-07 Aug, 2024 | 05:59

Directory traversal vulnerability in ZNC before 0.072 allows remote attackers to overwrite arbitrary files via a crafted DCC SEND request.

Vendor-znc n/a

Product-znc n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-21526

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.28% / 78.77%

7 Day CHG~0.00%

Published-30 Sep, 2020 | 14:43

Updated-04 Aug, 2024 | 14:30

An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.

Vendor-n/a Halo (FIT2CLOUD Inc.)

Product-halo n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3249

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-25.99% / 96.07%

7 Day CHG~0.00%

Published-18 Sep, 2009 | 20:00

Updated-07 Aug, 2024 | 06:22

Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable through modules/Campaigns/CampaignsAjax.php, modules/SalesOrder/SalesOrderAjax.php, modules/System/SystemAjax.php, modules/Products/ProductsAjax.php, modules/uploads/uploadsAjax.php, modules/Dashboard/DashboardAjax.php, modules/Potentials/PotentialsAjax.php, modules/Notes/NotesAjax.php, modules/Faq/FaqAjax.php, modules/Quotes/QuotesAjax.php, modules/Utilities/UtilitiesAjax.php, modules/Calendar/ActivityAjax.php, modules/Calendar/CalendarAjax.php, modules/PurchaseOrder/PurchaseOrderAjax.php, modules/HelpDesk/HelpDeskAjax.php, modules/Invoice/InvoiceAjax.php, modules/Accounts/AccountsAjax.php, modules/Reports/ReportsAjax.php, modules/Contacts/ContactsAjax.php, and modules/Portal/PortalAjax.php; and allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the step parameter in an Import action to the (4) Accounts, (5) Contacts, (6) HelpDesk, (7) Leads, (8) Potentials, (9) Products, or (10) Vendors module, reachable through index.php and related to modules/Import/index.php and multiple Import.php files.

Vendor-vtiger n/a

Product-vtiger_crm n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2792

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-17 Aug, 2009 | 16:00

Updated-07 Aug, 2024 | 05:59

Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PT parameter.

Vendor-joshua_oliver n/a

Product-really_simple_cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3318

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.44% / 79.93%

7 Day CHG~0.00%

Published-23 Sep, 2009 | 10:00

Updated-07 Aug, 2024 | 06:22

Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.

Vendor-breedveld n/a Joomla!

Product-joomla com_album n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3664

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.06% / 83.16%

7 Day CHG~0.00%

Published-11 Oct, 2009 | 22:00

Updated-07 Aug, 2024 | 06:38

Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. (dot dot) in the (1) p and (2) s parameters.

Vendor-nullam n/a

Product-nullam_blog n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3064

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.84% / 73.75%

7 Day CHG~0.00%

Published-03 Sep, 2009 | 17:00

Updated-07 Aug, 2024 | 06:14

Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _GET[filename] parameter.

Vendor-rein_velt n/a

Product-vedit n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-19305

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.96% / 75.53%

7 Day CHG~0.00%

Published-03 Aug, 2021 | 21:24

Updated-04 Aug, 2024 | 14:08

An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.

Vendor-metinfo n/a

Product-metinfo n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3625

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-6.22% / 90.50%

7 Day CHG~0.00%

Published-26 Oct, 2009 | 16:00

Updated-07 Aug, 2024 | 06:38

Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.

Vendor-sahana n/a

Product-sahana n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3542

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.62% / 85.10%

7 Day CHG~0.00%

Published-02 Oct, 2009 | 19:00

Updated-07 Aug, 2024 | 06:31

Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Vendor-kneuro n/a

Product-littlesite.php n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-3538

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.14% / 34.91%

7 Day CHG~0.00%

Published-02 Oct, 2009 | 19:00

Updated-16 Sep, 2024 | 19:15

Directory traversal vulnerability in thumb.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-allisclear n/a

Product-clear_content n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2112

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-18 Jun, 2009 | 21:00

Updated-07 Aug, 2024 | 05:36

Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _FORUM[settings_design_style] parameter.

Vendor-frank-karau n/a

Product-phpfk n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1678

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.68% / 70.66%

7 Day CHG~0.00%

Published-18 May, 2009 | 18:00

Updated-07 Aug, 2024 | 05:20

Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.

Vendor-bitweaver n/a

Product-bitweaver n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1770

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.12% / 77.38%

7 Day CHG~0.00%

Published-22 May, 2009 | 18:00

Updated-07 Aug, 2024 | 05:27

Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

Vendor-flyspeck n/a

Product-flyspeck_cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2449

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.47% / 63.74%

7 Day CHG~0.00%

Published-13 Jul, 2009 | 17:00

Updated-07 Aug, 2024 | 05:52

Directory traversal vulnerability in maillinglist/admin/change_config.php in ADbNewsSender before 1.5.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter.

Vendor-adbnewssender n/a

Product-adbnewssender n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1846

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-01 Jun, 2009 | 19:00

Updated-07 Aug, 2024 | 05:27

Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the THEME_FOLDER parameter to (1) Corporate/homepage.php, (2) Fusion/homepage.php, (3) Joombo/homepage.php, (4) Streamline/homepage.php, and (5) Structure/homepage.php in themes/.

Vendor-bjsintay n/a

Product-sitex n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-18178

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.78% / 81.95%

7 Day CHG~0.00%

Published-18 May, 2021 | 18:03

Updated-04 Aug, 2024 | 14:00

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."

Vendor-hongcms_project n/a

Product-hongcms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1748

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.22% / 78.26%

7 Day CHG~0.00%

Published-21 May, 2009 | 18:00

Updated-07 Aug, 2024 | 05:27

Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) webpages_form or (2) userman_form parameter.

Vendor-joost_horward n/a

Product-catviz n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2313

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.84% / 73.75%

7 Day CHG~0.00%

Published-02 Jul, 2009 | 10:00

Updated-07 Aug, 2024 | 05:44

Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter.

Vendor-jinzora n/a

Product-jinzora n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2333

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.51% / 80.43%

7 Day CHG~0.00%

Published-05 Jul, 2009 | 16:00

Updated-07 Aug, 2024 | 05:44

Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the menu parameter to admin/admin_menu.php, and the id parameter to (2) index.php and (3) admin/admin_edit.php; and (4) delete arbitrary local files via a .. (dot dot) in the id parameter to admin/admin_delete.php. NOTE: vector 2 can be leveraged for static code injection by sending a crafted menu parameter to admin/admin_menu.php, and then sending an id=../menu.csv request to index.php.

Vendor-cms.tut.su n/a

Product-cms_chainuk n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1779

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-5.31% / 89.65%

7 Day CHG~0.00%

Published-22 May, 2009 | 20:00

Updated-07 Aug, 2024 | 05:27

PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the form_include_template parameter.

Vendor-frax n/a

Product-php_recommend n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2444

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.90% / 74.68%

7 Day CHG~0.00%

Published-13 Jul, 2009 | 14:00

Updated-07 Aug, 2024 | 05:52

Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.

Vendor-adbnewssender n/a

Product-adbnewssender n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1649

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.31% / 79.00%

7 Day CHG~0.00%

Published-16 May, 2009 | 18:00

Updated-07 Aug, 2024 | 05:20

Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter.

Vendor-bicluc n/a

Product-belive n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2015

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.67% / 81.38%

7 Day CHG~0.00%

Published-09 Jun, 2009 | 19:00

Updated-07 Aug, 2024 | 05:36

Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

Vendor-ideal n/a Joomla!

Product-joomla com_moofaq n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2263

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.43% / 61.59%

7 Day CHG~0.00%

Published-30 Jun, 2009 | 10:00

Updated-07 Aug, 2024 | 05:44

Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Vendor-awesomephp n/a

Product-mega_file_manager n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2183

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-23 Jun, 2009 | 21:21

Updated-07 Aug, 2024 | 05:44

Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local files via a .. (dot dot) in the GLOBALS[g_campsiteDir] parameter.

Vendor-campware.org n/a

Product-campsite n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2265

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-93.27% / 99.80%

7 Day CHG~0.00%

Published-05 Jul, 2009 | 16:00

Updated-07 Aug, 2024 | 05:44

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Vendor-fckeditor n/a

Product-fckeditor n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-6224

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.49% / 80.27%

7 Day CHG~0.00%

Published-20 Feb, 2009 | 23:00

Updated-07 Aug, 2024 | 11:20

Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the plancia parameter.

Vendor-samelinux n/a

Product-way_of_the_warrior n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-2176

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.29% / 88.41%

7 Day CHG~0.00%

Published-23 Jun, 2009 | 21:21

Updated-07 Aug, 2024 | 05:44

Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) list parameter to code/confirm.php and the (2) template parameter to code/display.php.

Vendor-fuzzylime n/a

Product-fuzzylime_cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1486

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-29 Apr, 2009 | 18:06

Updated-07 Aug, 2024 | 05:13

Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.

Vendor-ninjadesigns n/a

Product-flatchat n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1502

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.31% / 79.00%

7 Day CHG~0.00%

Published-01 May, 2009 | 17:00

Updated-07 Aug, 2024 | 05:13

Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.

Vendor-matteoiammarrone n/a

Product-s-cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-0765

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.49% / 80.27%

7 Day CHG~0.00%

Published-03 Mar, 2009 | 18:00

Updated-07 Aug, 2024 | 04:48

Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configfile parameter.

Vendor-bookelves n/a

Product-kipper n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-0766

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.00% / 76.08%

7 Day CHG~0.00%

Published-03 Mar, 2009 | 18:00

Updated-16 Sep, 2024 | 19:57

Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-bookelves n/a

Product-kipper n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1246

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.12% / 77.38%

7 Day CHG~0.00%

Published-06 Apr, 2009 | 16:00

Updated-07 Aug, 2024 | 05:04

Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) row_mysql_blocks_center_down[file] parameter to includes/block_center_down.php; (2) row_mysql_blocks_center_top[file] includes/parameter to block_center_top.php; (3) row_mysql_blocks_left[file] parameter to includes/block_left.php; (4) row_mysql_blocks_right[file] parameter to includes/block_right.php; and row_mysql_bloginfo[theme] parameter to (5) includes/window_down.php and (6) includes/window_top.php.

Vendor-blogplus n/a

Product-blogplus n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1445

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.68% / 81.43%

7 Day CHG~0.00%

Published-27 Apr, 2009 | 19:00

Updated-07 Aug, 2024 | 05:13

Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequences in the lang parameter to libraries/helpdocs/help.php and (2) include and execute arbitrary local files via directory traversal sequences in the error parameter to index.php.

Vendor-ivano_culmine n/a

Product-webportal_cms n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1510

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-01 May, 2009 | 18:00

Updated-07 Aug, 2024 | 05:13

Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in ki_base/.

Vendor-koschtit n/a

Product-koschtit_image_gallery n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1479

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.12% / 77.38%

7 Day CHG~0.00%

Published-22 Oct, 2009 | 15:26

Updated-07 Aug, 2024 | 05:13

Directory traversal vulnerability in client/desktop/default.htm in Boxalino before 09.05.25-0421 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.

Vendor-boxalino n/a

Product-boxalino n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-1319

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.31% / 79.00%

7 Day CHG~0.00%

Published-17 Apr, 2009 | 10:00

Updated-07 Aug, 2024 | 05:04

Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the lang parameter to index.php.

Vendor-guestcal n/a

Product-guest_cal n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-0592

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-5.75% / 90.11%

7 Day CHG~0.00%

Published-16 Feb, 2009 | 17:00

Updated-07 Aug, 2024 | 04:40

Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.

Vendor-pnphpbb n/a

Product-pnphpbb2 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-0722

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-24 Feb, 2009 | 18:00

Updated-07 Aug, 2024 | 04:48

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the user cookie parameter.

Vendor-potato-scripts n/a

Product-potato_news n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2008-7064

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-6.93% / 91.03%

7 Day CHG~0.00%

Published-25 Aug, 2009 | 10:00

Updated-07 Aug, 2024 | 11:56

Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.

Vendor-quicksilver_forums n/a

Product-quicksilver_forums n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2009-0457

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-2.14% / 83.53%

7 Day CHG~0.00%

Published-06 Feb, 2009 | 01:00

Updated-07 Aug, 2024 | 04:31

Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the currentlang parameter to admin/case.php in the (1) Contact_Plus and (2) Reviews modules, and (3) the module_name parameter to admin/includes/FANCYNLOptions.php in the Fancy_NewsLetter module.

Vendor-magtrb n/a

Product-aja_portal n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-16245

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

View Details

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-9.8||CRITICAL

EPSS-15.93% / 94.50%

7 Day CHG+2.69%

Published-25 Aug, 2020 | 18:03

Updated-04 Aug, 2024 | 13:37

Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.

Vendor-n/a Advantech (Advantech Co., Ltd.)

Product-iview Advantech iView

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2017-5143

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs