CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- python** DISPUTED ** The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27...7.8 High
- facebook hhvmHHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior...7.5 High
- ivanti landesk management suiteOpen directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168...6.3 Medium
- androidIn savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2,...7.3 High
- fedoraproject sssd, debian linux, fedoraproject fedora +2 more +4 moreA vulnerability was found in sssd. If a user was configured with no home directory set, sssd...4.1 Medium
- lg lnb5110 firmware, lnb5320 firmware, lnb5320r firmware +15 more +17 moreLG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers...7.5 High
- openstack heat, redhat openstack, red hat openstack-heat +2 moreAn access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1...5.9 Medium
- redhat openstack, [unknown] openstack-mistral +1 moreAn accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log...5.9 Medium
- [unknown] redhat-certification, redhat certification, enterprise linux +2 moreredhat-certification does not properly restrict files that can be download through the /download...7.5 High
- redhat pcs, clusterlabs pacemaker command line interface, redhat enterprise linux +2 morepcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user...8.7 High
- ibm rational collaborative lifecycle management, rational doors next generation, rational engineering lifecycle manager +4 more +6 moreIBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an...4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreDevelopment Tools panels of an extension are required to load URLs for the panels as relative...7.5 High
- cisco elastic services controllerA vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an...3.3 Low
- heketi, redhat enterprise linux +1 moreInformation Exposure in Heketi7.8 High
- qnap systems inc. photo stationFiles or directories accessible to external parties vulnerability in picasa.php in Synology Photo...7.5 High
- roundcube webmail, debian linux +1 moreRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...7.8 High
- apple itunesAn issue was discovered in certain Apple products. iTunes before 12.7 is affected. The issue...5.5 Medium
- microsoft windows 10, windows server 2016 +1 moreMicrosoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update...5.5 Medium
- intelbras wrn 150 firmwareIntelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently...9.8 Critical
- inpsyde backwpupVulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup...7.5 High
- zte zx10 1800-2s, zxr10 160 firmware, zxr10 1800-2s firmware +2 more +4 moreThe ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized...9.8 Critical
- cisco asr 5000 software, cisco systems, inc. staros for asr 5000 series aggregated services routers +1 moreA vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS...5.0 Medium
- fortinet fortiweb, fortinet, inc. fortinet fortiweb +1 moreAn information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows...4.9 Medium
- inversepath tenshiTenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which...7.5 High
- ibm daeja viewoneIBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated...6.5 Medium
- drupal, drupal core, debian linux +2 moreFiles uploaded by anonymous users into a private file system can be accessed by other anonymous users6.5 Medium
- imagemagick, canonical ubuntu linux, opensuse leap +27 more +29 moreThe EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers...5.5 Medium
- linux kernel, redhat enterprise linux, enterprise mrg +2 moreThe VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr...5.5 Medium
- vmware spring framework, debian linux +1 moreFiles or Directories Accessible to External Parties in org.springframework:spring-core9.6 Critical
- owncloud, owncloud server +1 moreThe fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x...4.9 Medium
- digitaldesign cms project cmsDigitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access...5.0 Medium
- nextweb \(i\)siteNEXTWEB (i)Site stores databases under the web document root with insufficient access control,...5.0 Medium