CWE-552 · Files or Directories Accessible to External Parties (page 3)
Page 3 of 6 — CVEs classified under CWE-552, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7107 | High | 7.5 | 2024-09-26 | Files or Directories Accessible to External Parties vulnerability in National Keep Cyber Security Services CyberMath allows Collect Data from Common Resource L… |
CVE-2024-6878 | | 2024-09-18 | Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affect… | |
CVE-2024-8655 | Medium | 5.3 | 2024-09-10 | A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The… |
CVE-2024-39581 | High | 7.3 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker w… |
CVE-2024-36442 | High | 8.8 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system. |
CVE-2023-49198 | High | 7.5 | 2024-08-21 | Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalI… |
CVE-2024-41699 | Medium | 4.4 | 2024-08-20 | Priority – CWE-552: Files or Directories Accessible to External Parties |
CVE-2024-7729 | High | 7.5 | 2024-08-14 | The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files. |
CVE-2024-3913 | Medium | 5.9 | 2024-08-13 | An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. |
CVE-2024-38876 | High | 7.8 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3… |
CVE-2024-27182 | Medium | 4.9 | 2024-08-02 | In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by… |
CVE-2024-38429 | High | 7.5 | 2024-07-30 | Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties |
CVE-2024-40767 | Medium | 6.5 | 2024-07-24 | In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing… |
CVE-2024-6911 | High | 7.5 | 2024-07-22 | Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affec… |
CVE-2023-41916 | Medium | 6.5 | 2024-07-15 | In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manag… |
CVE-2024-6421 | High | 7.5 | 2024-07-10 | An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. |
CVE-2024-6209 | Critical | 10.0 | 2024-07-05 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access file… |
CVE-2024-32498 | Medium | 6.5 | 2024-07-05 | An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 exte… |
CVE-2024-39931 | Critical | 9.9 | 2024-07-04 | Gogs through 0.13.0 allows deletion of internal files. |
CVE-2024-4836 | High | 7.5 | 2024-07-02 | Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration fil… |
CVE-2024-0949 | Critical | 9.8 | 2024-06-27 | Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows… |
CVE-2024-4098 | Critical | 9.8 | 2024-06-20 | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts fu… |
CVE-2024-5056 | Medium | 6.5 | 2024-06-12 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behav… |
CVE-2024-23282 | Medium | 5.5 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A… |
CVE-2024-5262 | Critical | 9.8 | 2024-06-05 | Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files… |
CVE-2024-5587 | Medium | 5.3 | 2024-06-02 | A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the co… |
CVE-2024-3564 | High | 8.8 | 2024-06-01 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's… |
CVE-2024-5045 | Medium | 5.3 | 2024-05-17 | A vulnerability was found in SourceCodester Online Birth Certificate Management System 1.0. It has been declared as problematic. This vulnerability affects unk… |
CVE-2024-35183 | Medium | 4.4 | 2024-05-15 | wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent t… |
CVE-2024-3037 | High | 7.8 | 2024-05-14 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability… |
CVE-2024-34066 | High | 8.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accide… |
CVE-2023-39480 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2023-39479 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected… |
CVE-2023-48710 | Critical | 9.8 | 2024-04-15 | iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully… |
CVE-2024-2759 | High | 7.5 | 2024-04-04 | Improper access control vulnerability in Apaczka plugin for PrestaShop allows information gathering from saved templates without authentication.This issue affe… |
CVE-2024-29225 | Medium | 4.3 | 2024-04-04 | ELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive information by sending a sp… |
CVE-2024-2052 | High | 7.5 | 2024-03-18 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltration and download of… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-2364 | Low | 1.8 | 2024-03-10 | A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of t… |
CVE-2024-2056 | Critical | 9.8 | 2024-03-05 | Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service… |
CVE-2024-2055 | Critical | 9.8 | 2024-03-05 | The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not requir… |
CVE-2023-45594 | Medium | 6.8 | 2024-03-05 | A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily downlo… |
CVE-2024-21403 | Critical | 9.0 | 2024-02-13 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-24161 | High | 7.5 | 2024-02-02 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
CVE-2023-4550 | High | 7.5 | 2024-01-29 | Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files… |
CVE-2024-1005 | Medium | 5.3 | 2024-01-29 | A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-47202 | High | 7.8 | 2024-01-23 | A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installation… |
CVE-2023-52112 | Medium | 5.3 | 2024-01-16 | Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-6266 | High | 7.5 | 2024-01-11 | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of t… |
CVE-2023-6114 | High | 7.5 | 2023-12-26 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory… |
CVE-2023-48661 | Medium | 4.9 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially expl… |
CVE-2023-5907 | Medium | 6.5 | 2023-12-11 | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPre… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-6375 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain s… |
CVE-2023-39545 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-47612 | Medium | 6.8 | 2023-11-09 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8… |
CVE-2023-42534 | Medium | 6.3 | 2023-11-07 | Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege. |
CVE-2023-4930 | Medium | 6.5 | 2023-11-06 | The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowin… |
CVE-2023-31017 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse p… |
CVE-2023-5099 | High | 8.8 | 2023-10-31 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of… |
CVE-2023-5199 | Critical | 9.9 | 2023-10-30 | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' sh… |
CVE-2023-26580 | High | 7.5 | 2023-10-25 | Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated a… |
CVE-2023-33517 | High | 7.5 | 2023-10-23 | carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System). |
CVE-2023-4933 | Medium | 5.3 | 2023-10-16 | The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allow… |
CVE-2023-3155 | High | 7.2 | 2023-10-16 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `g… |
CVE-2023-5101 | Medium | 5.3 | 2023-10-09 | Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via… |
CVE-2023-23366 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-23365 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-45160 | High | 8.8 | 2023-10-05 | In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replac… |
CVE-2023-20235 | Medium | 6.5 | 2023-10-04 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could a… |
CVE-2023-5297 | Low | 3.7 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beife… |
CVE-2023-43856 | High | 7.5 | 2023-09-27 | Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. |
CVE-2023-3712 | Medium | 6.6 | 2023-09-12 | Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This… |
CVE-2023-4588 | Medium | 6.8 | 2023-09-06 | File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an aut… |
CVE-2023-4743 | Low | 3.1 | 2023-09-03 | A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?… |
CVE-2023-41717 | Medium | 5.5 | 2023-08-31 | Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. |
CVE-2023-4475 | High | 7.5 | 2023-08-22 | An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to uninte… |
CVE-2023-38952 | High | 7.5 | 2023-08-03 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not va… |
CVE-2023-38948 | High | 7.2 | 2023-08-03 | An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadin… |
CVE-2023-37551 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the… |
CVE-2023-32226 | High | 8.3 | 2023-07-30 | Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method… |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-34316 | Medium | 6.5 | 2023-07-10 | An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file… |
CVE-2023-2538 | Medium | 5.8 | 2023-07-05 | A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attack… |
CVE-2023-34834 | Medium | 5.3 | 2023-06-29 | A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about t… |
CVE-2023-36664 | High | 7.8 | 2023-06-25 | Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). |
CVE-2022-42834 | Low | 3.3 | 2023-06-23 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big Sur 11.7.3. An app m… |
CVE-2023-29931 | Critical | 9.8 | 2023-06-22 | laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php. |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
CVE-2023-2976 | Medium | 5.5 | 2023-06-14 | Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cr… |
CVE-2023-33568 | High | 7.5 | 2023-06-13 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppl… |
CVE-2023-32684 | Low | 2.7 | 2023-05-30 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk ima… |
CVE-2023-31066 | Critical | 9.1 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thro… |
CVE-2023-31064 | High | 7.5 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 thro… |
CVE-2022-45450 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) bef… |
CVE-2023-20184 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20183 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-2766 | Medium | 5.3 | 2023-05-17 | A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobi… |
CVE-2023-29820 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE… |