CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects food ordering system SililaWijesinghe Food Ordering System admin exposure of information through directory listing 6.9 Medium
- btcpay server server BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure 9.3 Critical
- open-emr openemr OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot 7.5 High
- wppconnect wppconnect-server WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files 6.9 Medium
- apache openoffice Apache OpenOffice: Local file inclusion via GStreamer plugin 5.5 Medium
- apache openoffice Apache OpenOffice: Local file inclusion via SQL provider and flat file database references 5.5 Medium
- redimp otterwiki An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src 6.9 Medium
- apache software foundation wicket Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader 6.3 Medium
- socfortress copilot SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount 9.3 Critical
- @clerk nuxt Nuxt dev server exposes generated appSecret through Vite file serving 4.8 Medium
- @clerk nuxt Nuxt dev server exposes private runtime config through the Nitro dev bundle 5.9 Medium
- hcl software bigfix aex HCL BigFix AEX is affected by multiple security vulnerabilities. 8.6 High
- smci mbd-x12spi Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability 4.9 Medium
- intranda goobi-viewer-core Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer 9.8 Critical
- splunk soar Files or Directories Accessible to External Parties in Splunk SOAR 9.9 Critical
- polonel trudesk Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads 8.2 High
- oracle peoplesoft enterprise peopletools Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:... 4.2 Medium
- @vitest browser, ui, vitest-dev vitest +1 more +3 more Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file 6.5 Medium
- satya-vinay events-management-system satya-vinay Events-Management-System project.sql file access 6.9 Medium
- tsplus remote access Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access 8.7 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 more Windows Projected File System Information Disclosure Vulnerability 5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more WebDAV Information Disclosure Vulnerability 6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Event Viewer Information Disclosure Vulnerability 6.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 more Windows Bind Filter Driver Information Disclosure Vulnerability 5.5 Medium
- typo3 cms TYPO3 CMS - Security Misconfiguration in Form Framework 6.3 Medium
- sap se netweaver enterprise portal Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal 5.3 Medium
- code-projects matrimonial system code-projects Matrimonial System matrimony.sql file access 6.9 Medium
- webtoffee order export & order import for woocommerce Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() 5.3 Medium
- docling, docling-project docling-slim +1 more Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode 5.9 Medium
- atlassian bamboo, bamboo data center, bitbucket data center +14 more +16 more h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira... 9.3 Critical
- growi, inc. growi An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker... 6.9 Medium
- hkuds vibe-trading HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path 8.7 High
- apache http server Apache HTTP Server: mod_dav_fs property database read access 5.3 Medium
- shopify tophat, toptech systems tms7 +1 more Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties 10.0 Critical
- ibm concert Multiple Vulnerabilities in IBM Concert Software 6.2 Medium
- ibm concert Multiple Vulnerabilities in IBM Concert Software 6.2 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials 7.7 High
- No product listed NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url... 7.5 High
- brain trust gallery - private photo vault Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure 7.1 High
- unknown yogeta wp cloud Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download 8.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Defender Firewall Service Information Disclosure Vulnerability 5.5 Medium
- unknown pods Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback 6.8 Medium
- No product listed An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway... 6.5 Medium
- configserver security & firewall, webpros configserver security & firewall +1 more An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI... 9.2 Critical
- siyuan-note siyuan SiYuan before v3.8.2 TLS Private Key Disclosure via getFile 8.7 High
- arubanetworks fabric composer Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer 5.3 Medium
- arubanetworks fabric composer Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API 5.4 Medium
- arubanetworks fabric composer Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer 8.8 High
- nousresearch hermes-agent Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool 7.6 High
- triliumnext trilium Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature 8.1 High
- Show olderLoading…