Total
7108 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-19228 | 1 Laobancms | 1 Laobancms | 2024-11-21 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation. | |||||
| CVE-2018-19197 | 1 Xiaocms | 1 Xiaocms | 2024-11-21 | 5.5 MEDIUM | 4.9 MEDIUM |
| An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory traversal. | |||||
| CVE-2018-19181 | 1 Yunucms | 1 Yunucms | 2024-11-21 | 6.4 MEDIUM | 7.5 HIGH |
| statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file. | |||||
| CVE-2018-19124 | 2 Microsoft, Prestashop | 2 Windows, Prestashop | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files. | |||||
| CVE-2018-19052 | 4 Debian, Lighttpd, Opensuse and 1 more | 5 Debian Linux, Lighttpd, Backports Sle and 2 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character. | |||||
| CVE-2018-19043 | 1 Media File Manager Project | 1 Media File Manager | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI. | |||||
| CVE-2018-19042 | 1 Media File Manager Project | 1 Media File Manager | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI. | |||||
| CVE-2018-19040 | 1 Media File Manager Project | 1 Media File Manager | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. | |||||
| CVE-2018-19003 | 1 Ge | 6 Ex2100e, Ex2100e Firmware, Ls2100e and 3 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails to restrict the ability of an attacker to gain access to restricted information. | |||||
| CVE-2018-1999020 | 1 Opennetworking | 1 Onos | 2024-11-21 | 5.8 MEDIUM | 5.5 MEDIUM |
| Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java line 35 that can result in arbitrary file deletion (overwrite). This attack appear to be exploitable via a specially crafted zip file should be uploaded. | |||||
| CVE-2018-18990 | 1 Lcds | 1 Laquis Scada | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process. | |||||
| CVE-2018-18950 | 1 Kindeditor | 1 Kindeditor | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication. | |||||
| CVE-2018-18936 | 1 Popojicms | 1 Popojicms | 2024-11-21 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter. | |||||
| CVE-2018-18894 | 1 Lexmark | 98 6500e, 6500e Firmware, C748 and 95 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server. | |||||
| CVE-2018-18890 | 1 1234n | 1 Minicms | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename. | |||||
| CVE-2018-18876 | 1 Columbiaweather | 2 Weather Microserver, Weather Microserver Firmware | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the underlying operating system. | |||||
| CVE-2018-18869 | 1 Phome | 1 Empirecms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter. | |||||
| CVE-2018-18863 | 1 Ngahr | 1 Resourcelink | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| NGA ResourceLink 20.0.2.1 allows local file inclusion. | |||||
| CVE-2018-18831 | 1 Mingsoft | 1 Mcms | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter. | |||||
| CVE-2018-18777 | 1 Microstrategy | 1 Microstrategy Web | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product. | |||||