CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- propump and controls, inc. osprey pump controller, propumpservice osprey pump controller firmware +1 moreCVE-2023-283757.5 High
- stimulsoft designerStimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.7.5 High
- amano xofficeamano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.7.5 High
- saysis starcitiesFiles or Directories Accessible to External Parties in Saysis Starcities7.5 High
- onekeyadminonekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the...7.5 High
- onekeyadminonekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the...7.5 High
- blogengine blogengine.netStored cross-site scripting in BlogEngine.NET version 3.3.8.05.3 Medium
- correos oficial, unknown correos oficial +1 moreCorreos Oficial <= 1.2.0.2 - Unauthenticated Arbitrary File Download7.5 High
- open-emr openemrA Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read...7.5 High
- delta electronics diaenergieImproper Authorization8.8 High
- crmebCRMEB 4.4.4 is vulnerable to Any File download.7.5 High
- lmxcmslmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction...4.9 Medium
- easy images project imagesEasy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the...7.5 High
- unknown all-in-one security (aios), updraftplus all-in-one security +1 moreAll In One WP Security & Firewall < 5.1.3 - Configuration Leak5.3 Medium
- openstack swift, debian linux +1 moreOpenStack Swift XML external entities (XXE) Injection6.5 Medium
- zyxel ax7501-b0 firmwareA vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0...4.4 Medium
- weave gitops, weaveworks weave-gitops +1 moreGitOps Run allows for Kubernetes workload injection8.9 High
- axiell iguanaLocal File Inclusion in Axiell Iguana CMS8.8 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access6.5 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access7.5 High
- dahuasecurity dhi-dss4004-s2 firmware, dhi-dss7016d-s2 firmware, dhi-dss7016dr-s2 firmware +2 more +4 moreSome Dahua software products have a vulnerability of unrestricted download of file. After...6.5 Medium
- cedcommerce wholesale market for woocommerceWholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download7.5 High
- cedcommerce wholesale market for woocommerceWholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download4.9 Medium
- dragino lg01 lora firmwareThe web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https:...7.5 High
- wavlink wl-wn531g3 firmwareWAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030...7.5 High
- fluenx deepl pro api translation, unknown deepl pro api translation plugin +1 moreDeepL Pro API Translation < 1.7.5 - API Key Disclosure7.5 High
- watchtowerhq watchtower, whatarmy watchtowerhq (wordpress plugin) +1 moreWordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability7.5 High
- villatheme s2w – import shopify to woocommerce (wordpress plugin), s2w - import shopify to woocommerce +1 moreWordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability4.9 Medium
- payaraPayara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF7.5 High
- openharmonyArbitrary file read via download_server.6.2 Medium
- amitmerchant1990 markdownifyMarkdownify has Files or Directories Accessible to External Parties5.5 Medium
- github enterprise serverIncomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files5.7 Medium
- opennebulaThe FILES Directive allows arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from that template, which may result in Information Disclosure.6.5 Medium
- jenkins nunit, jenkins project nunit plugin +1 moreJenkins NUnit Plugin vulnerable to Protection Mechanism Failure5.3 Medium
- helpful project helpfulHelpful < 4.5.26 - Information Disclosure5.3 Medium
- ucms project ucmsThere is a file inclusion vulnerability in the template management module in UCMS 1.68.8 High
- unknown download monitorDownload Monitor < 4.5.98 - Admin+ Arbitrary File Download4.9 Medium
- clash project clashA misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows...7.8 High
- fwupdWhen creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated...6.5 Medium
- dompdf project dompdfDompdf allows remote file inclusion because URI validation failure does not halt font registration7.5 High
- onedev project onedevGit Repository Disclosure in Onedev7.5 High
- tendacn ac6 firmwareTenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi...7.5 High
- keycloakKeycloak has Files or Directories Accessible to External Parties4.3 Medium
- red hat ansible-tower, redhat ansible automation platform, ansible automation platform early access +2 more +4 moreA flaw was found in ansible-tower where the default installation is vulnerable to job isolation...8.8 High
- xplodedthemes wpide – file manager & code editor (wordpress plugin), wpide - file manager \& code editor +1 moreWordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability4.9 Medium
- lana downloads manager, lanacodes lana downloads manager +1 moreLana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download6.5 Medium
- airspan airvelocity, airvelocity 1500 firmware +1 moreAn authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vu…6.5 Medium
- ibm robotic process automation, robotic process automation as a service, robotic process automation for cloud pak +2 moreIBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain...4.4 Medium
- unknown wsm downloader, wsm downloader project downloader +1 moreWSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download7.5 High
- project-source-code-download project project-source-code-download, unknown wordpress project source code download +1 moreProject Source Code Download <= 1.0.0 - Unauthenticated Backup Download7.5 High
- Show moreLoading…