Total
6532 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-37128 | 1 Huawei | 1 Harmonyos | 2024-08-04 | 9.8 Critical |
| HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file. | ||||
| CVE-2021-37099 | 1 Huawei | 1 Harmonyos | 2024-08-04 | 9.1 Critical |
| There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete any file. | ||||
| CVE-2021-37023 | 1 Huawei | 1 Harmonyos | 2024-08-04 | 6.5 Medium |
| There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads and writes in non-distributed directories on any device on the network.. | ||||
| CVE-2021-36717 | 1 Synerion | 1 Timenet | 2024-08-04 | 5.4 Medium |
| Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more information required to further compromise the system. | ||||
| CVE-2021-36425 | 1 Phpwcms | 1 Phpwcms | 2024-08-04 | 5.4 Medium |
| Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. | ||||
| CVE-2021-36471 | 1 Adminlte.io | 1 Adminlte | 2024-08-04 | 9.8 Critical |
| Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. | ||||
| CVE-2021-36157 | 2 Linuxfoundation, Redhat | 2 Cortex, Openshift | 2024-08-04 | 5.3 Medium |
| An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.) | ||||
| CVE-2021-36156 | 1 Grafana | 1 Loki | 2024-08-04 | 5.3 Medium |
| An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message. | ||||
| CVE-2021-36168 | 1 Fortinet | 1 Fortiportal | 2024-08-04 | 6.5 Medium |
| A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before 6.2.5 allows authenticated attacker to disclosure information via crafted GET request with malicious parameter values. | ||||
| CVE-2021-35980 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more | 2024-08-04 | 7.8 High |
| Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2021-35975 | 1 Systematica | 6 Financial Calculator, Fix Adapter, Http Adapter and 3 more | 2024-08-04 | 5.3 Medium |
| Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter (up to v.1.8.0.15), MSSQL MessageBus Proxy (up to v.1.1.06), Financial Calculator (up to v.1.3.05), FIX Adapter (up to v.2.4.0.25) | ||||
| CVE-2021-35521 | 1 Idemia | 12 Morphowave Compact Md, Morphowave Compact Md Firmware, Morphowave Compact Mdpi and 9 more | 2024-08-04 | 5.9 Medium |
| A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated attackers to achieve denial of services and information disclosure via TCP/IP packets. | ||||
| CVE-2021-35397 | 1 Drogon | 1 Drogon | 2024-08-04 | 7.5 High |
| A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files. The vulnerability is due to lack of proper input validation for requested path. An attacker could exploit this vulnerability by sending crafted HTTP request with specific path to read. Successful exploitation could allow the attacker to read files that should be restricted. | ||||
| CVE-2021-35380 | 1 Solari | 1 Termtalk Server | 2024-08-04 | 7.5 High |
| A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore). | ||||
| CVE-2021-35054 | 1 Minecraft | 1 Minecraft | 2024-08-04 | 7.5 High |
| Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files. | ||||
| CVE-2021-35027 | 1 Zyxel | 2 Zywall Vpn2s, Zywall Vpn2s Firmware | 2024-08-04 | 7.5 High |
| A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information. | ||||
| CVE-2021-34860 | 1 Dlink | 2 Dap-2020, Dap-2020 Firmware | 2024-08-04 | 6.5 Medium |
| This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to the webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-12103. | ||||
| CVE-2021-34805 | 1 Land-software | 1 Faust Iserver | 2024-08-04 | 7.5 High |
| An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal. | ||||
| CVE-2021-34820 | 1 Aat | 1 Novus Management System | 2024-08-04 | 7.5 High |
| Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2 | ||||
| CVE-2021-34638 | 1 Wpdownloadmanager | 1 Wordpress Download Manager | 2024-08-04 | 6.5 Medium |
| Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions. | ||||