CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- trend micro vpn proxy one pro (consumer), trendmicro vpn proxy one pro +1 moreTrend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some...7.8 High
- multisafepay plugin for woocommerce, plugin for woocommerce (wordpress plugin) +1 moreWordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability5.3 Medium
- givewp, givewp (wordpress plugin) +1 moreWordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability5.5 Medium
- wavlink wl-wn530hg4 firmwareAn access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers...5.3 Medium
- reolink e1 zoom firmwareThe web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/...7.5 High
- reolink e1 zoom firmwareThe web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root...5.9 Medium
- unknown download monitorDownload Monitor < 4.5.91 - Admin+ Arbitrary File Download4.9 Medium
- siemens sicam gridedge (classic), sicam gridedge essential arm, sicam gridedge essential gds arm +2 more +4 moreA vulnerability has been identified in SICAM GridEdge Essential ARM (All versions), SICAM...5.3 Medium
- google android, samsung mobile devices +1 moreExposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local...2.3 Low
- iobit advanced systemcareIOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of...7.8 High
- codesys plcwinnt, runtime toolkit +1 moreCODESYS runtime system prone to directory acces8.8 High
- 74cms 74cmsse74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component ...7.5 High
- docker desktopDocker Desktop 4.3.0 has Incorrect Access Control.8.4 High
- ginadmin project ginadminArbitrary file read in ginadmin7.5 High
- red hat wildfly, redhat jboss enterprise application platform, single sign-on +1 more +3 moreWildfly-Core user account mismanagement7.8 High
- wow-company hover effects, hover effects – easily create any hover effect (wordpress plugin) +1 moreWordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability6.8 Medium
- wow-company counter box, counter box (wordpress) +1 moreWordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability6.8 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreSandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin8.5 High
- cmseasycmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the...6.5 Medium
- contec sv-cpt-mc310 firmwareSolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/Solar_Ftp...5.5 Medium
- fapolicyd project fapolicydA vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how...8.4 High
- xxyopen novel-plusnovel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.7.5 High
- unknown web to print shop : udraw, webtoprint web to print shop\ +1 moreuDraw < 3.3.3 - Unauthenticated Arbitrary File Access7.5 High
- kitesky kitecmsKiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background...6.5 Medium
- octa code accessibilityA vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0)...4.4 Medium
- asana desktopAsana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick...6.5 Medium
- movie seat reservation project seat reservationMovie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure...7.5 High
- mozilla firefoxThe sourceMapURL feature in devtools was missing security checks that would have allowed a...6.5 Medium
- adminer, debian linux +1 moreFiles or Directories Accessible to External Parties in Adminer7.5 High
- 74cms74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url...7.5 High
- naver whale browser, navercorp whale +1 moreWhale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer...6.5 Medium
- cuppacmsCuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.5.3 Medium
- cvrf-csaf-converter project cvrf-csaf-converterXML External Entities Vulnerability in CVRF-CSAF-Converter6.1 Medium
- secomea gatemanagerLogged-in Administrator may get unrestricted file system access9.9 Critical
- keep archeevoArcheevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an...7.5 High
- horizontcms project horizontcmsHorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via...7.5 High
- drogonArbitrary File Write7.5 High
- cesanta mongooseArbitrary File Write9.8 Critical
- xwiki, xwiki xwiki-platform +1 moreMissing authorization in xwiki-platform5.5 Medium
- maharaIn Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of...4.3 Medium
- seur oficial oficial, unknown seur oficial +1 moreSEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download4.9 Medium
- thinkupthemes responsive vector maps, unknown rvm – responsive vector maps +1 moreRVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read6.5 Medium
- taogogo taocmsIn taocms 3.0.1 after logging in to the background, there is an Arbitrary file download...4.9 Medium
- taogogo taocmsAn issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can...4.9 Medium
- reolink rlc-410w firmwareAn information disclosure vulnerability exists due to a web server misconfiguration in the...8.1 High
- kernel util-linux, fedoraproject fedora +1 moreCVE-2021-3996 does not affect BellSoft software5.5 Medium
- kernel util-linux, fedoraproject fedora +1 moreCVE-2021-3995 does not affect BellSoft software5.5 Medium
- fresenius kabi agilia connect wifi, fresenius-kabi agilia sp mc wifi firmware +1 moreFresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties5.3 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary...8.6 High
- google android, samsung mobile devices +1 moreAn implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows...4.4 Medium
- Show moreLoading…