CWE-22

High likelihood

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

9,225 vulnerabilities with CWE-22
CVE-2021-21569 MEDIUM
Dell NetWorker 18.1.0.1-19.4.0.3 - Path Traversal
CVSS 6.8
CVE-2021-20034 CRITICAL
SonicWall SMA 200/210/400/410/500v < 9.0.0.10-28sv - Unauthenticated Arbitrary File Deletion via Path Traversal Bypass
CVSS 9.1
CVE-2021-40103 HIGH
Concrete CMS < 8.5.5 - Path Traversal and Arbitrary File Read
CVSS 7.5
CVE-2021-40098 CRITICAL
Concrete CMS < 8.5.5 - Path Traversal and Remote Code Execution via External Form Regular Expression
CVSS 9.8
CVE-2021-40097 HIGH
Concrete CMS < 8.5.5 - Authenticated Path Traversal and Remote Code Execution via bFilename Parameter
CVSS 8.8
CVE-2021-40349 MEDIUM
e7d Speed Test <0.5.3 - Path Traversal
CVSS 5.3
CVE-2021-22868 MEDIUM
GitHub Enterprise Server < 2.22.22 - Authenticated Path Traversal via GitHub Pages Configuration
CVSS 4.3
CVE-2021-41381 HIGH
Payara Micro Community < 5.2021.6 - Path Traversal
CVSS 7.5
CVE-2021-22013 HIGH
VMware Cloud Foundation 3.0-5.0 & vCenter Server - Path Traversal & Info Disclosure via API
CVSS 7.5
CVE-2021-22005 CRITICAL KEV
VMware Cloud Foundation 3.0-4.0 and vCenter Server - Arbitrary File Upload via Analytics Service
CVSS 9.8
CVE-2021-41087 MEDIUM
in-toto-golang - Privilege Escalation
CVSS 5.6
CVE-2021-24639 HIGH
OMGF WordPress Plugin < 4.5.4 - Authenticated Path Traversal and Arbitrary File Deletion via omgf_ajax_empty_dir
CVSS 8.1
CVE-2021-24638 CRITICAL
OMGF < 4.5.4 - Unauthenticated Path Traversal and Arbitrary File Write via REST API Handle Parameter
CVSS 9.1
CVE-2021-3806 MEDIUM
Pardus Software Center - Path Traversal
CVSS 5.3
CVE-2021-39208 MEDIUM
SharpCompress < 0.29.0 - Path Traversal via Destination Directory Slash Omission
CVSS 4.3
CVE-2021-27341 CRITICAL
OpenSIS CE <7.6 - Local File Inclusion
CVSS 9.8
CVE-2021-33692 HIGH
SAP Cloud Connector <2.0 - Path Traversal
CVSS 7.5
CVE-2021-40964 MEDIUM
TinyFileManager <=2.4.6 - Path Traversal
CVSS 6.5
CVE-2021-40444 HIGH KEV
Microsoft Office Word Malicious MSHTML RCE
CVSS 8.8
CVE-2021-23043 MEDIUM
BIG-IP 11.6.0-11.6.4 - Path Traversal in Configuration Utility
CVSS 6.5
CVE-2021-38163 CRITICAL KEV
SAP NetWeaver (Visual Composer 7.0 RT) - Command Injection
CVSS 9.9
CVE-2021-37532 MEDIUM
SAP Business One 10 - Authenticated Path Traversal
CVSS 4.3
CVE-2021-33685 MEDIUM
SAP Business One <10.0 - Path Traversal
CVSS 6.5
CVE-2021-40357 MEDIUM
Teamcenter Active Workspace < 4.3.10 - Path Traversal
CVSS 4.9
CVE-2021-37200 HIGH
SINEC NMS < 1.0 SP1 - Path Traversal via Crafted HTTP Request
CVSS 7.7
Details
Vulnerabilities 9,225
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits