CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- dell supportassist os recoveryDell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive...4.4 Medium
- campcodes farm management systemCampcodes Farm Management System file information disclosure6.9 Medium
- jenkins git client, jenkins project git client plugin +1 moreJenkins Git client Plugin file system information disclosure vulnerability4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files4.3 Medium
- brother industries, ltd ads-1350w, ads-1800w, ads-2700we +410 more +412 moreUnauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.4.3 Medium
- brother industries, ltd dcp-1610w, dcp-1610we, dcp-1610wr +448 more +450 moreUnauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.5.3 Medium
- phpgt domphpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact7.1 High
- google android, mediatek, inc. mt6580, mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6983, mt6985, mt8175, mt8195, mt8196, mt8321, mt8365, mt8370, mt8385, mt8390, mt8395, mt8666, mt8667, mt8673, mt8678, mt8765, mt8766, mt8768, mt8771, mt8775, mt8781, mt8786, mt8788, mt8788e, mt8789, mt8791t, mt8795t, mt8796, mt8797, mt8798, mt8893 +1 moreIn devinfo, there is a possible information disclosure due to a missing SELinux policy. This...5.5 Medium
- oblak studio srbtranslatinWordPress Srbtranslatin plugin <= 3.2.0 - Sensitive Data Exposure vulnerability5.8 Medium
- greg tailpressWordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability5.8 Medium
- thom4 wp-lessWordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerability5.8 Medium
- r1bbit yimioayimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via...4.2 Medium
- apache nifiApache NiFi: Potential Insertion of MongoDB Password in Provenance Record6.9 Medium
- enalean tuleapTuleap dumps the Redis password into the generated troubleshooting archives5.3 Medium
- matt cromwell give – divi donation modulesWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerability5.8 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerability5.9 Medium
- wp chill htaccess file editorWordPress Htaccess File Editor <= 1.0.19 - Broken Authentication vulnerability5.3 Medium
- jan syski megabipCSRF in MegaBIP6.9 Medium
- gitlabInsertion of Sensitive Information into Externally-Accessible File or Directory in GitLab6.5 Medium
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.7.7 - Sensitive Data Exposure vulnerability5.3 Medium
- sap se netweaver as for java (adobe document services)Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)6.8 Medium
- sap se netweaver as for java (adobe document services)Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)6.8 Medium
- broadcom brocade sannav, brocade sannav +1 moreconfiguration secrets are logged in support-save4.4 Medium
- red hat 3scale api management platform 2, redhat 3scale api management platform +1 moreSystem: pdf invoices of the developer users can be seen if the url is known5.3 Medium
- advanced file manager shortcodesAdvanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal8.8 High
- nozomi networks arcSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.05.2 Medium
- samsung portable ssd t5 software for windowsAn issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows....7.3 High
- siemens sinema remote connect clientA vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1)....7.6 High
- apostrophecms sanitize-html, fedoraproject fedora +1 moresanitize-html Information Exposure vulnerability5.3 Medium
- dell data protection searchDell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain...8.8 High
- nia rrj nueva ecija engineer online portal, rrj nueva ecija engineer online portal +1 moreRRJ Nueva Ecija Engineer Online Portal file information disclosure5.3 Medium
- bvrp software slmailInsertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail7.5 High
- paijp lte-pic32-writerlte-pic32-writer's sendto.txt may disclose URL and the API key8.9 High
- awsm wp job openingsWP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing5.3 Medium
- unknown active directory integration / ldap integration, miniorange active directory integration \/ ldap integration +1 moreActive Directory Integration < 4.1.10 - Unauthenticated Log Disclosure7.5 High
- siemens simatic pcs neo (administration console) v4.0, simatic pcs neo (administration console) v4.0 update 1, simatic pcs neo +2 moreA vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All...5.5 Medium
- php-fusion phpfusionArbitrary File Read in Fusion File Manager5.5 Medium
- angular-server-side-configuration project angular-server-side-configurationangular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend9.9 Critical
- micro focus netiq identity manager, netiq identity manager +1 moreFile existence disclosue vulnerability in IDM plugin1.8 Low
- weave gitops, weaveworks weave-gitops +1 moreGitOps Run allows for Kubernetes workload injection8.9 High
- kubernetes cri-o, fedoraproject extra packages for enterprise linux, fedora +7 more +9 moreCri-o: /etc/passwd tampering privesc7.8 High
- jetbrains teamcityIn JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in...6.5 Medium
- cisco ios xe rom monitor, ios xe software +1 moreCisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure Vulnerability4.6 Medium
- weave gitops, weaveworks weave-gitops +1 moreWeave GitOps leaked cluster credentials into logs on connection errors9.0 Critical
- siemens simatic pcs 7 v8.2, simatic pcs 7 v9.0, simatic pcs 7 v9.1 +7 more +9 moreA vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS...7.8 High
- palo alto networks cortex xdr agentCortex XDR Agent: File Information Exposure Vulnerability When Generating Support File5.0 Medium
- canonical apportApport file permission bypass through emacs byte compilation errors6.5 Medium
- hbs project hbsFile disclosure in hbs4.0 Medium
- cisco unified communications managerCisco Unified Communications Manager Information Disclosure Vulnerability4.9 Medium
- onedev project onedevPost-Auth External Entity Expansion (XXE)7.7 High
- Show moreLoading…