Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

CVEs (172)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-48476 1Jetbrains 1Ktor Jun 17, 2026 Apr 24, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
CVE-2022-3693 1Fileorbis 1Fileorbis Jun 17, 2026 Jan 13, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System: from unspecified before 10.6.3.
CVE-2022-36928 1Zoom 1Zoom Jun 17, 2026 Jan 9, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
CVE-2022-46826 1Jetbrains 1Intellij Idea Jun 17, 2026 Dec 8, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.
CVE-2022-2265 1Identity And Directory Management System Project 1Identity And Directory Management System Jun 17, 2026 Sep 21, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25
CVE-2022-24774 1Cyclonedx 1Bill Of Materials Repository Server Jun 17, 2026 Mar 22, 2022 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading...Show more CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.Show less
CVE-2021-1364 1Cisco 2Unified Communications Manager Unified Communications Manager Im And Presence Service Jun 17, 2026 Jan 20, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system....Show more Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1357 1Cisco 2Unified Communications Manager Unified Communications Manager Im And Presence Service Jun 17, 2026 Jan 20, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system....Show more Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1355 1Cisco 2Unified Communications Manager Unified Communications Manager Im And Presence Service Jun 17, 2026 Jan 20, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system....Show more Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2021-1282 1Cisco 2Unified Communications Manager Unified Communications Manager Im And Presence Service Jun 17, 2026 Jan 20, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system....Show more Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.Show less
CVE-2020-27130 1Cisco 1Security Manager Jun 17, 2026 Nov 17, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequence...Show more A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitrary files from the affected device.Show less
CVE-2018-3744 1Html Pages Project 1Html Pages Nov 21, 2024 May 29, 2018 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.

Previous 1...5 6 7 89