CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- century systems co., ltd. futurenet ip-k series, futurenet ma-e300 series, futurenet ma-p series +2 more +4 moreFutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and...6.9 Medium
- edgelesssys contrastContrast before 1.12.1 Insecure LUKS2 Persistent Storage6.9 Medium
- edgelesssys constellationConstellation allows insecure use of LUKS2 persistent storage partitions8.3 High
- eclipse vert.xVert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories6.3 Medium
- hcl software unica platform, hcltech unica +1 moreUnprotected files are impacting HCL Unica Platform5.3 Medium
- gladinet centrestack, centrestack and triofox, triofox +2 moreGladinet CentreStack and TrioFox Local File Inclusion Flaw7.5 High
- juniper junos spaceJunos Space: Arbitrary file download vulnerability in web interface7.1 High
- apache kylinApache Kylin: improper restriction of file read7.5 High
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayUnrestricted Binary allows File Enumeration in Underlying Operating System6.5 Medium
- gen digital ccleanerCCleaner Link Following Local Privilege Escalation Vulnerability7.3 High
- dstack-tee dstackdstack has insecure LUKS2 persistent storage partitions that may be opened and used8.5 High
- 9001 copypartycopyparty: Sharing a single file does not fully restrict access to other files in source folder5.3 Medium
- cdata api serverCData API Server MySQL Misconfiguration Information Disclosure Vulnerability4.3 Medium
- dos co., ltd. ss1, ss1 cloud +1 moreFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier...6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry5.3 Medium
- chshcms mccmsMCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an...5.4 Medium
- contentkeeper technologies web applianceContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode8.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Unauthenticated File Access via URL5.3 Medium
- ollamaOllama allows deletion of arbitrary files6.6 Medium
- nvidia gpu display driversNVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate...7.8 High
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories...5.5 Medium
- sitecore experience commerce (xc), experience manager (xm), experience platform (xp) +1 more +3 moreSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read8.7 High
- vmware bitnamicharts/appsmith, bitnamicharts/drupal, bitnamicharts/wordpress +2 moreMounted Kubernetes Secrets under a predictable path located within the web server document root10.0 Critical
- No product listedOA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui...8.1 High
- coloradoftp serverColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure9.3 Critical
- edgelesssys contrastEdgeless Systems Contrast before 1.9.1 Insecure Volume Mount5.1 Medium
- roocode roo code, roocodeinc roo-code +1 moreRoo Code allows Potential Remote Code Execution via .vscode/settings.json8.1 High
- brother industries, ltd. multiple driver installers for windowsMultiple Brother driver installers for Windows contain a privilege escalation vulnerability. If...8.5 High
- gogsGogs deletion of internal files allows remote command execution10.0 Critical
- samba, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSamba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session4.9 Medium
- ingydotnet yaml-libyaml, tinita yaml::libyaml +1 moreYAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified9.1 Critical
- jct airpointerLocal File Inclusion4.1 Medium
mcp-markdownify-servernpmMarkdownify MCP Server allows attackers to read arbitrary files8.2 High- avast business antivirusLack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files7.3 High
- smarsh telemessage, telemessage service, tm sgnl +2 moreThe TeleMessage service through 2025-05-05 is based on a JSP application in which the heap...4.0 Medium
- sscms siteserver cmsAn arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows...7.1 High
- lerouxyxchire client database management systemSourceCodester Client Database Management System exposure of information through directory listing6.9 Medium
- senior-walter online student clearance systemSourceCodester Online Student Clearance System exposure of information through directory listing6.9 Medium
- unknown secure downloadsSecure Downloads < 1.2.3 - Admin+ Arbitrary File Download6.5 Medium
- microsoft visual studio code, visual studio code copilot chat extension +1 moreVisual Studio Code Security Feature Bypass Vulnerability7.1 High
- redhat pagurePagure: _update_file_in_git() follows symbolic links in temporary clones7.6 High
- sonicwall sma100, sma 100 firmware, sma 200 firmware +4 more +6 moreA vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to...8.8 High
- symfonia ready Local File Inclusion in Ready_7.1 High
- schneider electric connexium network managerCWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that...8.2 High
- glpi-project glpi-inventory-pluginGLPI Inventory plugin has Improper Access Control Vulnerability8.2 High
- oretnom23 employee and visitor gate pass logging systemSourceCodester Employee and Visitor Gate Pass Logging System exposure of information through directory listing6.9 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop admin exposure of information through directory listing6.9 Medium
- codename065 download managerDownload Manager < 3.3.07 - Unauthenticated Data Exposure4.6 Medium
- mennekes smart / premium charging stationsMennekes smart/premium charges systems, Arbitrary file download using ReadFile endpoint7.1 High
- siemens tecnomatix plant simulation v2302, tecnomatix plant simulation v2404, tecnomatix plant simulation +2 moreA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302...6.9 Medium
- Show moreLoading…