CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- totolink a702r firmwareDirectory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows...5.5 Medium
- apache flinkApache Flink directory traversal attack: reading remote files through the REST API7.5 High
- titanhq spamtitanSpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.5.3 Medium
- aviatrix controllerAn issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection...7.5 High
- facebook whatsapp business for ios, whatsapp, whatsapp business +1 more +3 moreImproper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior...4.6 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, apache beam +16 more +18 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.0 High
- dell emc networker, networker +1 moreDell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability....6.8 Medium
- dell emc networker, networker +1 moreDell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment...6.8 Medium
- b&r sitemanagerSiteManager Denial of Service via Local File Inclusion Vulnerability7.7 High
- b&r sitemanagerSiteManager Local File Inclusion Vulnerability7.7 High
- openenclaveSocket syscalls can leak enclave memory contents in Open Enclave6.8 Medium
- glpi-project glpiUnauthenticated File Deletion in GLPI7.4 High
- redhat ansible, ansible community community collections +1 moreA flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have…6.6 Medium
- apache tapestryImproper file downloads in Apache Tapestry5.3 Medium
- cisco ios xe software, ios +1 moreCisco IOS XE Software Arbitrary File Overwrite Vulnerability4.4 Medium
node-git-servernpmUnauthorized File Access in node-git-server7.5 High- filemanagerpro file managermndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups...7.5 High
- apache wicket, fortress +1 moreExposure of Sensitive Information to an Unauthorized Actor in Apache Wicket7.5 High
- electronArbitrary file read via window-open IPC in Electron6.8 Medium
- dell powerprotect data manager, power protect data manager, powerprotect x400 firmware +2 moreDell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions...7.7 High
- bundlerInsecure path handling in Bundler7.8 High
- cisco unified contact center expressCisco Unified Contact Center Express Improper API Authorization Vulnerability5.4 Medium
- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to privilege escalation of organization member9.8 Critical
- gazie project gazieAn issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in...9.8 Critical
- mono monoxMonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX...7.2 High
- byobu, canonical ubuntu linux +1 moreByobu apport hook uploads user's ~/.screenrc4.3 Medium
- canonical extplorereXtplorer exposes /usr and /etc/extplorer over HTTP5.8 Medium
- zoom meetingsZoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary...6.3 Medium
- elideRead permissions not enforced for client provided filter expressions in Elide http client6.8 Medium
- google androidAn issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks...5.3 Medium
- frappeIn core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with...7.5 High
- prestashopPossible information disclosure in PrestaShop7.6 High
- zammadAn issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources...5.3 Medium
- containers podman, libpod project libpod, redhat enterprise linux +1 more +3 morePodman has Files or Directories Accessible to External Parties5.9 Medium
- siemens ozw672, ozw772, ozw672 firmware +1 more +3 moreA vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10...7.5 High
- changing servisign windows versions, changingtec servisign +1 moreServiSign Windows Versions- Arbitrary File Deletion8.3 High
- changing servisign windows versions, changingtec servisign +1 moreServiSign Windows Versions- Arbitrary File Access6.1 Medium
- ruckuswireless unleashed, zonedirector 1200 firmware +1 moreIncorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102...9.8 Critical
- wpseeds wp database backupThe WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in...7.5 High
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file...2.7 Low
- phantomjsPhantomJS Arbitrary File Read7.5 High
- ibm cloud orchestrator, cloud orchestrator enterprise +1 moreIBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through...4.0 Medium
- zohocorp manageengine datasecurity plusAn issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed...4.3 Medium
- sap dynamic tier, iq, sql anywhere +1 more +3 moreA binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP...5.5 Medium
- vbulletinvBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core...6.5 Medium
- silverstripeBroken access control on files5.3 Medium
- intenogroup eg200 firmwareInteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that...6.5 Medium
- cpanelcPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form...6.5 Medium
- mcafee, llc data loss prevention (dlpe) for windows, mcafee data loss prevention endpoint +1 moreDLP Endpoint log file redirection to arbitrary locations7.5 High
- siemens digsi 5 engineering software, siemens ag all other siprotec 5 device types with cpu variants cp300 and cp100 and the respective ethernet communication modules, siprotec 5 device types 6md85, 6md86, 6md89, 7um85, 7sa87, 7sd87, 7sl87, 7vk87, 7sa82, 7sa86, 7sd82, 7sd86, 7sl82, 7sl86, 7sj86, 7sk82, 7sk85, 7sj82, 7sj85, 7ut82, 7ut85, 7ut86, 7ut87 and 7ve85 with cpu variants cp300 and cp100 and the respective ethernet communication modules +3 more +5 moreA vulnerability has been identified in SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87,...7.5 High
- Show moreLoading…