CWE-219: Storage of File with Sensitive Data Under Web Root
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
A kind of CWE-552 Files or Directories Accessible to External Parties.
From the CWE List. © The MITRE Corporation.
Newest
- chamilo chamilo-lms Chamilo LMS CStudio upload flow allows unauthenticated remote code execution 9.8 Critical
-
@actual-app/sync-servernpm Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers 4.2 Medium - astro Server source code is exposed to the public if sourcemaps are enabled 7.8 High
- avtec outpost 0810, outpost uploader utility, avtecinc outpost 0810 firmware +2 more Avtec Outpost Storage of File with Sensitive Data Under Web Root 8.7 High
- triangle microworks scada data gateway Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability 5.3 Medium
- airspan airvelocity, airvelocity 1500 firmware +1 more An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vu… 6.5 Medium
- reolink rlc-410w firmware An information disclosure vulnerability exists due to a web server misconfiguration in the... 8.1 High
- horde imp Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request... 5.0 Medium