CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- priorityPriority – CWE-552: Files or Directories Accessible to External Parties4.4 Medium
- cayin technology cms-20, cms-60, cms-se +14 more +16 moreCAYIN Technology CMS - Sensitive File Download7.5 High
- phoenix contact charx sec-3000 (1139022), charx sec-3050 (1139018), charx sec-3100 (1139012) +9 more +11 morePhoenix Contact: Start sequence allows attack during the boot process5.9 Medium
- siemens omnivise t3000 application server r9.2, omnivise t3000 domain controller r9.2, omnivise t3000 product data management (pdm) r9.2 +13 more +15 moreA vulnerability has been identified in Omnivise T3000 Application Server (All versions >= R9.2),...8.5 High
- apache linkis, apache software foundation linkis basic management services +1 moreApache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability4.9 Medium
- matrix tafnit v8, matrix-globalservices tafnit +1 moreMatrix - CWE-552: Files or Directories Accessible to External Parties7.5 High
- openstack novaOpenStack Nova vulnerable to unauthorized access to potentially sensitive data6.5 Medium
- perkinelmer processplus, perkin elmer process plus +1 moreUnauthenticated Local File Inclusion8.7 High
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading6.5 Medium
- pepperl+fuchs oit1500-f113-b12-cb, oit200-f113-b12-cb, oit500-f113-b12-cb +5 more +7 morePepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products7.5 High
- abb matrix series, nexus series, aspect-ent-12 firmware +19 more +21 moreunauthorized file access9.4 Critical
- gogsDuplicate Advisory: Gogs allows deletion of internal files9.9 Critical
- openstack cinder, glance, nova +2 moreOpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access6.5 Medium
- edito cmsLFI in sites managed by Edito CMS7.5 High
- talya informatics elektrawebImproper Access Control in Talya Informatics' Elektraweb9.8 Critical
- 3uu shariff wrapperShariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion9.8 Critical
- schneider electric modicon m340, network module, modicon m340, ethernet tcp/ip bmxnoe0110, network module, modicon m340, modbus/tcp bmxnoe0100 +5 more +7 moreCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may...6.5 Medium
- apple ipados, macos, watchos +2 more +4 moreThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, watchOS...5.5 Medium
- projectdiscovery interactshProjectDiscovery Interactsh - Files or Directories Accessible to External Parties9.3 Critical
- casbin casdoorCasdoor Configuration File app.conf file access6.9 Medium
- vanderwijk content blocks (custom post widget), content blocks +1 moreContent Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- oretnom23 online birth certificate management systemSourceCodester Online Birth Certificate Management System admin file access6.9 Medium
- wolfi-dev wolfictlwolfictl leaks GitHub tokens to remote non-GitHub git servers4.4 Medium
scrapyPyPIScrapy allows redirect following in protocols other than HTTP6.5 Medium- papercut mf, ng, ng, papercut mf +2 moreArbitrary File Deletion in PaperCut NG/MF Web Print7.8 High
- pterodactyl wingsArbitrary File Write/Read in Pterodactyl wings8.5 High
- softing secure integration serverSofting Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability4.4 Medium
- softing secure integration serverSofting Secure Integration Server OPC UA Gateway Directory Creation Vulnerability6.6 Medium
- combodo itopiTop limit pages/exec.php script to PHP files9.8 Critical
- alsendo sp. z o. o. apaczkaImproper access control in Apaczka plugin for PrestaShop7.5 High
- elecom co.,ltd. wrc-g01-w, wrc-x3200gst3-b, wmc-2lx-b +2 more +4 moreWRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier allow a network-adjacent...4.3 Medium
- dotcms, dotcms core +1 moreIn dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is...4.5 Medium
- schneider electric easergy t200 (dnp3) models: t200i, t200e, t200p, t200s, t200h, easergy t200 (iec104) models: t200i, t200e, t200p, t200s, t200h, easergy t200 (modbus) models: t200i, t200e, t200p, t200s, t200h +1 more +3 moreCWE-552: Files or Directories Accessible to External Parties vulnerability exists that could...7.5 High
- apache pulsarApache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying8.5 High
- kirillmakarov musicshelfMusicshelf Backup androidmanifest.xml backup1.8 Low
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy Loopback Services Remotely Accessible Unauthenticated9.8 Critical
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy Unauthenticated File Manager Vulnerability9.8 Critical
- ailux imx6, imx6 bundle +1 moreA CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded...6.8 Medium
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability9.0 Critical
- vmware aria operations for networksAria Operations for Networks contains a local file read vulnerability. A malicious actor with...4.9 Medium
- mrcmsMRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming...7.5 High
- opentext appbuilderUnauthenticated Arbitrary File Read7.5 High
- shanxi diankeyun technology noderpShanxi Diankeyun Technology NODERP log file access5.3 Medium
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA local file inclusion vulnerability on the Trend Micro Apex One management server could allow a...7.8 High
- huawei emui, harmonyos +1 moreUnauthorized file access vulnerability in the wallpaper service module. Successful exploitation...5.3 Medium
- backupbliss backup migration, inisev backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure7.5 High
- awesomemotive duplicator, unknown duplicator pro +1 moreDuplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure7.5 High
- dell vapp manager, powermax os, solutions enabler virtual appliance +1 more +3 moreDell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A...4.9 Medium
- bitapps file managerFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal6.5 Medium
- apache strutsApache Struts: File upload component had a directory traversal vulnerability9.8 Critical
- Show moreLoading…