Total
10265 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-25859 | 1 Phillipsdata | 1 Blesta | 2026-06-17 | N/A | 7.1 HIGH |
| A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code. | |||||
| CVE-2024-25830 | 1 F-logic | 2 Datacube3, Datacube3 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password. | |||||
| CVE-2024-25711 | 2 Fedoraproject, Reproducible Builds | 2 Fedora, Diffoscope | 2026-06-17 | N/A | 7.5 HIGH |
| diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted. | |||||
| CVE-2024-25693 | 3 Esri, Linux, Microsoft | 3 Portal For Arcgis, Linux Kernel, Windows | 2026-06-17 | N/A | 9.9 CRITICAL |
| There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. | |||||
| CVE-2024-25659 | 1 Nokia | 1 Transcend Network Management System | 2026-06-17 | N/A | 7.2 HIGH |
| In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory. | |||||
| CVE-2024-25620 | 1 Helm | 1 Helm | 2026-06-17 | N/A | 6.4 MEDIUM |
| Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. Users unable to upgrade should check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies. | |||||
| CVE-2024-25614 | 1 Arubanetworks | 1 Arubaos | 2026-06-17 | N/A | 5.5 MEDIUM |
| There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller. | |||||
| CVE-2024-25567 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 8.1 HIGH |
| Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten. | |||||
| CVE-2024-25461 | 1 Creatio | 1 Crm Creatio | 2026-06-17 | N/A | 7.5 HIGH |
| Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information via a crafted request to the terrasoft.axd component. | |||||
| CVE-2024-25386 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file. | |||||
| CVE-2024-25183 | 1 Vvveb | 1 Vvvebjs | 2026-06-17 | N/A | 7.5 HIGH |
| givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. | |||||
| CVE-2024-25164 | 1 Idurarapp | 1 Idurar | 2026-06-17 | N/A | 7.5 HIGH |
| iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality. | |||||
| CVE-2024-25156 | 1 Fortra | 1 Goanywhere Managed File Transfer | 2026-06-17 | N/A | 6.5 MEDIUM |
| A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. | |||||
| CVE-2024-25154 | 1 Fortra | 1 Filecatalyst Direct | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage. | |||||
| CVE-2024-25136 | 2026-06-17 | N/A | 7.5 HIGH | ||
| There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. | |||||
| CVE-2024-25125 | 1 Treasuredata | 1 Digdag | 2026-06-17 | N/A | 5.3 MEDIUM |
| Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to information disclosure and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2024-25123 | 1 Open-mss | 1 Mission Support System | 2026-06-17 | N/A | 7.3 HIGH |
| MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2024-25065 | 1 Apache | 1 Ofbiz | 2026-06-17 | N/A | 9.1 CRITICAL |
| Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue. | |||||
| CVE-2024-25006 | 1 Xenforo | 1 Xenforo | 2026-06-17 | N/A | 8.1 HIGH |
| XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import. | |||||
| CVE-2024-25000 | 1 Ivanti | 1 Avalanche | 2026-06-17 | N/A | 8.8 HIGH |
| A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. | |||||