CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google android, samsung mobile devices +1 moreKeeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1...4.0 Medium
- google android, samsung mobile devices +1 moreImplicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1...4.0 Medium
- google android, samsung mobile devices +1 moreIncorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically...6.1 Medium
- zohocorp manageengine adselfservice plusManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain...4.3 Medium
- phpgurukul bus pass management systemIn Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which...7.5 High
- apereo opencastFiles Accessible to External Parties in Opencast9.9 Critical
- samsung internetInsecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows...4.0 Medium
- mcafee database security, mcafee,llc mcafee database security (dbsec) +1 moreDenial of Service in Database Security on Windows6.1 Medium
- trend micro security 2021 (consumer), trendmicro antivirus\+ security, internet security +2 more +4 moreTrend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the...5.5 Medium
- philips mri 1.5t, mri 3t, mri 1.5t firmware +1 more +3 morePhilips MRI 1.5T and 3T Information Exposure5.9 Medium
- hitachi vantara pentaho, vantara pentaho business intelligence server +1 moreAn issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence...4.3 Medium
- gnome glib, debian linux, netapp active iq unified manager +2 moreA flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak...5.5 Medium
- netscout ngeniusoneNETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the...5.7 Medium
- hitachi content platform anywhereHitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If...7.5 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains multiple local privilege escalation vulnerabilities due to improper...7.8 High
- kubernetesSymlink Exchange Can Allow Host Filesystem Access8.8 High
- expertpdfA local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read...7.5 High
- google android, samsung mobile devices +1 moreAn improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep...4.0 Medium
- emby emby.releasesUnauthenticated file read in Emby Server8.6 High
- cisco nexus insightsCisco Nexus Insights Authenticated Information Disclosure Vulnerability4.3 Medium
- unit4 mik.starlightThe function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design)...6.5 Medium
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure7.5 High
- rconfigAn information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This...6.5 Medium
- joyplus-cms project joyplus-cmsA vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access...7.5 High
- gitit project gititIn gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.7.5 High
- nagios xiNagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation...7.5 High
- dell dbutil, dbutildrv2.sys firmware +1 moreDell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control...8.8 High
- codesys control, control rte, control runtime system toolkit +4 more +6 moreIn CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.7.5 High
- mozilla thunderbirdIf Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected...5.9 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreApplication specific tokens can change their own scope8.8 High
- ethercreative logsFiles or Directories Accessible to External Parties in ether/logs7.2 High
- schneider-electric easergy t300 firmwareA CWE-269: Improper Privilege Management vulnerability exists in EnerlinÕX ComÕX versions prior...4.3 Medium
- sensepost gowitnessA vulnerability exists in gowitness < 2.3.6 that allows an unauthenticated attacker to perform an...7.5 High
- mcafee database security, mcafee,llc mcafee database security (dbsec) +1 moreIncorrect access to deleted scripts vulnerability in McAfee DBSec4.9 Medium
- [unknown] redhat-certification, redhat certification +1 moreIt has been discovered that redhat-certification does not restrict file access in the /update...9.1 Critical
- [unknown] redhat-certification, redhat certification +1 moreIt has been discovered that redhat-certification is not properly configured and it lists all...7.5 High
- invoiceplaneIn InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and...7.5 High
docassemblePyPIUnauthorized access through URL manipulationNo score- cisco catalyst sd-wan manager, sd-wan solution, sd-wan vbond orchestrator +11 more +13 moreCisco SD-WAN Software Arbitrary File Corruption Vulnerability4.4 Medium
- cisco firepower threat defense software, secure firewall threat defense +1 moreCisco Firepower Threat Defense Software Command File Overwrite Vulnerability6.0 Medium
- openapi-generator openapi generator, openapitools openapi-generator +1 moreCreation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin4.0 Medium
shopware/productionPackagist,shopware/shopwarePackagist +1 moreExposure of .env if project root is configured as web root in shopware/productionNo score- mndpsingh287 theme editorTheme Editor < 2.6 - Authenticated Arbitrary File Download4.9 Medium
- cisco ios xe, ios xe software +1 moreCisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability4.4 Medium
- typo3, typo3 typo3.cms +1 moreUnrestricted File Upload in Form Framework8.6 High
- [unknown] redhat-certification, redhat certification +1 moreIt has been discovered in redhat-certification that any unauthorized user may download any file...5.3 Medium
highcharts-export-servernpmVulnerability allowing for reading internal HTTP resourcesNo score- red hat ansible-tower, redhat ansible tower +1 moreA flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape...6.7 Medium
- cisco nx-os software, nx-os +1 moreCisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability9.8 Critical
- redhat openshift container platformA privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to th…8.8 High
- Show moreLoading…