Total
7155 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2016-10965 | 1 Creativeinteractivemedia | 1 Real3d Flipbook | 2024-11-21 | 7.5 High |
| The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion. | ||||
| CVE-2016-10924 | 1 Zedna Ebook Download Project | 1 Zedna Ebook Download | 2024-11-21 | N/A |
| The ebook-download plugin before 1.2 for WordPress has directory traversal. | ||||
| CVE-2016-10828 | 1 Cpanel | 1 Cpanel | 2024-11-21 | N/A |
| cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). | ||||
| CVE-2016-10759 | 1 Precurio | 1 Precurio | 2024-11-21 | N/A |
| The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads. | ||||
| CVE-2016-10751 | 1 Osclass | 1 Osclass | 2024-11-21 | N/A |
| osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload. | ||||
| CVE-2016-10733 | 1 Projectsend | 1 Projectsend | 2024-11-21 | N/A |
| ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. | ||||
| CVE-2016-10726 | 1 Duraspace | 1 Dspace | 2024-11-21 | N/A |
| The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI. | ||||
| CVE-2016-10561 | 1 Bitty Project | 1 Bitty | 2024-11-21 | N/A |
| Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests. | ||||
| CVE-2016-10538 | 2 Cli Project, Debian | 2 Cli, Debian Linux | 2024-11-21 | N/A |
| The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to. | ||||
| CVE-2016-10528 | 1 Restafary Project | 1 Restafary | 2024-11-21 | N/A |
| restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified. | ||||
| CVE-2015-9546 | 1 Google | 1 Android | 2024-11-21 | 4.8 Medium |
| An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted file path. The Samsung ID is SVE-2015-4363 (November 2015). | ||||
| CVE-2015-9538 | 1 Imagely | 1 Nextgen Gallery | 2024-11-21 | 6.5 Medium |
| The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. | ||||
| CVE-2015-9480 | 1 Robot-cpa | 1 Robotcpa | 2024-11-21 | 7.5 High |
| The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. | ||||
| CVE-2015-9473 | 1 Estrutura-basica Project | 1 Estrutura-basica | 2024-11-21 | 7.5 High |
| The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. | ||||
| CVE-2015-9470 | 1 Ionadas | 1 History Collection | 2024-11-21 | 7.5 High |
| The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. | ||||
| CVE-2015-9464 | 1 S3bubble | 1 S3bubble-amazon-s3-html-5-video-with-adverts | 2024-11-21 | 7.5 High |
| The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter. | ||||
| CVE-2015-9463 | 1 S3bubble | 1 S3bubble-amazon-s3-audio-streaming | 2024-11-21 | 7.5 High |
| The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter. | ||||
| CVE-2015-9406 | 1 Mtheme-unus Project | 1 Mtheme-unus | 2024-11-21 | 7.5 High |
| Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php. | ||||
| CVE-2015-9287 | 1 Cam | 1 The University Of Cambridge Web Authentication System Apache Authentication Agent | 2024-11-21 | N/A |
| Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location. | ||||
| CVE-2015-9277 | 1 Mailenable | 1 Mailenable | 2024-11-21 | N/A |
| MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled. | ||||