CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- tyler technologies court case management plusTyler Technologies Magistrate Court Case Management Plus stores backups insecurely5.3 Medium
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- telit cinterion bgs5, ehs5, els61 +17 more +19 moreA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit...6.8 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows...6.3 Medium
- shamimsplugins front end pmFront End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing6.5 Medium
- nvidia gpu display driver, gpu display driver, vgpu driver, and cloud gaming driver, virtual gpu +2 moreCVE7.8 High
- jonashjalmarsson html filter and csv-file searchHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- bloafer php to page, php to page project to page +1 morePHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode9.9 Critical
- idattend idwebMissing Authentication In IDAttend’s IDWeb Application7.5 High
- carrental project carrentalcarRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end...7.5 High
- awsm wp job openingsWP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing5.3 Medium
- imagely nextgen gallery, unknown wordpress gallery plugin +1 moreNextGEN Gallery < 3.39 - Admin+ Arbitrary File Read and Delete7.2 High
- sick apu0200, apu0200 firmware +1 moreFiles or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged...5.3 Medium
- qnap music stationMusic Station7.7 High
- qnap music stationMusic Station7.7 High
- 1e clientElevated Temp Directory Execution in 1E Client8.8 High
- cisco ios xe software, ios xe +1 moreA vulnerability in the on-device application development workflow feature for the Cisco IOx...6.5 Medium
- rockoaXinhu RockOA start backup3.7 Low
- iteachyou dreamer cmsDreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the...7.5 High
- honeywell pc23/43, pd43, pd45, px240, pm23/43 +7 more +9 morePotential user privilege escalation6.6 Medium
- delinea secret serverFile accessibility vulnerability in Delinea Secret Server6.8 Medium
- dreamer cms, iteachyou dreamer cms +1 moreDreamer CMS file access3.1 Low
- zscaler proxyInappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local...5.5 Medium
- asustor adm, data master +1 moreAn Arbitrary File Movement vulnerability was found on the ADM7.5 High
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +20 more +22 moreCODESYS Files or Directories Accessible to External Parties in CmpApp6.5 Medium
- zkteco biotimeInsecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read...7.5 High
- jizhicmsAn arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1...7.2 High
- sysaid, sysaid on-premises +1 moreSysaid - CWE-552: Files or Directories Accessible to External Parties8.3 High
- zabbixUnauthorized limited filesystem access from preprocessing8.5 High
- delta electronics infrasuite device masterDelta Electronics InfraSuite Device Master Improper Access Control6.5 Medium
- tyan s5552 bmc, s5552\/s5552gm2nr firmware, s5552\/s5552gm4nr firmware +2 more +4 moreTLS Private Key Accessible to External Parties5.8 Medium
- mcl-collection mcl-net, mcl-net firmware +1 moreA Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default...5.3 Medium
- artifex ghostscript, debian linux, fedoraproject fedora +2 moreArtifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the ...7.8 High
- apple macosAn access issue was addressed with improved access restrictions. This issue is fixed in macOS...3.3 Low
- laravels project laravelslaravel-s vulnerable to Local File Inclusion9.8 Critical
- jflyfox jfinal cmsjfinal CMS 5.1.0 has an arbitrary file read vulnerability.7.5 High
- google guavaUse of temporary directory for file creation in `FileBackedOutputStream` in Guava5.5 Medium
- dolibarr erp\/crmDolibarr vulnerable to unauthenticated database access7.5 High
- lima-vm limaIn Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file2.7 Low
- apache inlongApache InLong: Insecurity direct object references cancelling applications7.5 High
- apache inlongApache InLong: Insecure direct object references for inlong sources9.1 Critical
- acronis agent, cyber protect 15, cyber protect +2 moreSensitive information disclosure and manipulation due to improper authorization. The following...5.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Software API Vulnerabilities5.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Software API Vulnerabilities5.4 Medium
- jinher oa, weaver e-office +1 moreWeaver OA jx2_config.ini file access5.3 Medium
- unknown kiwiz invoices certification & pdf system, kiwiz invoices certification \& pdf system project invoices certification \& pdf system +1 moreKIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download7.5 High
- webroot secureanywhereAn issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before...5.5 Medium
- siemens simatic cloud connect 7 cc712, simatic cloud connect 7 cc716, 6gk1411-1ac00 firmware +1 more +3 moreA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1...5.3 Medium
- gdidees cmsGDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup...7.5 High
- unknown shopping cart & ecommerce store, wpeasycart wp easycart +1 moreShopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI7.2 High
- Show moreLoading…