Total
6552 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1560 | 1 Amministrazione Aperta Project | 1 Amministrazione Aperta | 2024-08-03 | 6.5 Medium |
| The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link | ||||
| CVE-2022-1554 | 1 Clinical-genomics | 1 Scout | 2024-08-03 | 7.5 High |
| Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52. | ||||
| CVE-2022-1392 | 1 Commoninja | 1 Videos Sync Pdf | 2024-08-03 | 7.5 High |
| The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues | ||||
| CVE-2022-1390 | 1 Admin Word Count Column Project | 1 Admin Word Count Column | 2024-08-03 | 9.8 Critical |
| The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique | ||||
| CVE-2022-1391 | 1 Kanev | 1 Cab Fare Calculator | 2024-08-03 | 9.8 Critical |
| The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. | ||||
| CVE-2022-1373 | 1 Softing | 6 Edgeaggregator, Edgeconnector, Opc and 3 more | 2024-08-03 | 7.2 High |
| The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk. | ||||
| CVE-2022-1166 | 1 Nootheme | 1 Jobmonster | 2024-08-02 | 5.3 Medium |
| The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen. | ||||
| CVE-2022-1128 | 2 Google, Microsoft | 2 Chrome, Windows | 2024-08-02 | 6.5 Medium |
| Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross-origin data via a crafted HTML page. | ||||
| CVE-2022-1119 | 1 Simplefilelist | 1 Simple-file-list | 2024-08-02 | 7.5 High |
| The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7. | ||||
| CVE-2022-0959 | 1 Postgresql | 1 Pgadmin 4 | 2024-08-02 | 6.5 Medium |
| A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. | ||||
| CVE-2022-1000 | 1 Tiny File Manager Project | 1 Tiny File Manager | 2024-08-02 | 9.8 Critical |
| Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. | ||||
| CVE-2022-0779 | 1 User-meta | 1 User Meta User Profile Builder And User Management | 2024-08-02 | 6.5 Medium |
| The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads | ||||
| CVE-2022-0673 | 1 Eclipse | 1 Lemminx | 2024-08-02 | 6.5 Medium |
| A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal. | ||||
| CVE-2022-0679 | 1 Narnoo Distributor Project | 1 Narnoo Distributor | 2024-08-02 | 9.8 Critical |
| The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration. | ||||
| CVE-2022-0665 | 1 Pimcore | 1 Pimcore | 2024-08-02 | 6.5 Medium |
| Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. | ||||
| CVE-2022-0493 | 1 String Locator Project | 1 String Locator | 2024-08-02 | 4.9 Medium |
| The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed. | ||||
| CVE-2022-0436 | 1 Gruntjs | 1 Grunt | 2024-08-02 | 5.5 Medium |
| Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. | ||||
| CVE-2022-0401 | 1 W-zip Project | 1 W-zip | 2024-08-02 | 9.8 Critical |
| Path Traversal in NPM w-zip prior to 1.0.12. | ||||
| CVE-2022-0369 | 2024-08-02 | N/A | ||
| Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Restore Workspace feature. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17227. | ||||
| CVE-2022-0320 | 1 Wpdeveloper | 1 Essential Addons For Elementor | 2024-08-02 | 9.8 Critical |
| The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques. | ||||