CWE-552 · Files or Directories Accessible to External Parties (page 3)
Page 3 of 5 — CVEs classified under CWE-552, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34066 | High | 8.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accide… |
CVE-2023-39480 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2023-39479 | High | 8.8 | 2024-05-03 | Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected… |
CVE-2023-48710 | Critical | 9.8 | 2024-04-15 | iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully… |
CVE-2024-2759 | High | 7.5 | 2024-04-04 | Improper access control vulnerability in Apaczka plugin for PrestaShop allows information gathering from saved templates without authentication.This issue affe… |
CVE-2024-29225 | Medium | 4.3 | 2024-04-04 | ELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive information by sending a sp… |
CVE-2024-2052 | High | 7.5 | 2024-03-18 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltration and download of… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-2364 | Low | 1.8 | 2024-03-10 | A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of t… |
CVE-2024-2056 | Critical | 9.8 | 2024-03-05 | Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service… |
CVE-2024-2055 | Critical | 9.8 | 2024-03-05 | The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not requir… |
CVE-2023-45594 | Medium | 6.8 | 2024-03-05 | A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily downlo… |
CVE-2024-21403 | Critical | 9.0 | 2024-02-13 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-24161 | High | 7.5 | 2024-02-02 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
CVE-2023-4550 | High | 7.5 | 2024-01-29 | Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files… |
CVE-2024-1005 | Medium | 5.3 | 2024-01-29 | A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-47202 | High | 7.8 | 2024-01-23 | A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installation… |
CVE-2023-52112 | Medium | 5.3 | 2024-01-16 | Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-6266 | High | 7.5 | 2024-01-11 | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of t… |
CVE-2023-6114 | High | 7.5 | 2023-12-26 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory… |
CVE-2023-48661 | Medium | 4.9 | 2023-12-14 | Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially expl… |
CVE-2023-5907 | Medium | 6.5 | 2023-12-11 | The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPre… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-6375 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain s… |
CVE-2023-39545 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-47612 | Medium | 6.8 | 2023-11-09 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8… |
CVE-2023-42534 | Medium | 6.3 | 2023-11-07 | Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege. |
CVE-2023-4930 | Medium | 6.5 | 2023-11-06 | The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowin… |
CVE-2023-31017 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse p… |
CVE-2023-5099 | High | 8.8 | 2023-10-31 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of… |
CVE-2023-5199 | Critical | 9.9 | 2023-10-30 | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' sh… |
CVE-2023-26580 | High | 7.5 | 2023-10-25 | Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated a… |
CVE-2023-33517 | High | 7.5 | 2023-10-23 | carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System). |
CVE-2023-4933 | Medium | 5.3 | 2023-10-16 | The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allow… |
CVE-2023-3155 | High | 7.2 | 2023-10-16 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `g… |
CVE-2023-5101 | Medium | 5.3 | 2023-10-09 | Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via… |
CVE-2023-23366 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-23365 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-45160 | High | 8.8 | 2023-10-05 | In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replac… |
CVE-2023-20235 | Medium | 6.5 | 2023-10-04 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could a… |
CVE-2023-5297 | Low | 3.7 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beife… |
CVE-2023-43856 | High | 7.5 | 2023-09-27 | Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. |
CVE-2023-3712 | Medium | 6.6 | 2023-09-12 | Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This… |
CVE-2023-4588 | Medium | 6.8 | 2023-09-06 | File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an aut… |
CVE-2023-4743 | Low | 3.1 | 2023-09-03 | A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?… |
CVE-2023-41717 | Medium | 5.5 | 2023-08-31 | Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. |
CVE-2023-4475 | High | 7.5 | 2023-08-22 | An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to uninte… |
CVE-2023-38952 | High | 7.5 | 2023-08-03 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not va… |
CVE-2023-38948 | High | 7.2 | 2023-08-03 | An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadin… |
CVE-2023-37551 | Medium | 6.5 | 2023-08-03 | In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the… |
CVE-2023-32226 | High | 8.3 | 2023-07-30 | Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method… |
CVE-2023-29450 | High | 8.5 | 2023-07-13 | JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Z… |
CVE-2023-34316 | Medium | 6.5 | 2023-07-10 | An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file… |
CVE-2023-2538 | Medium | 5.8 | 2023-07-05 | A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attack… |
CVE-2023-34834 | Medium | 5.3 | 2023-06-29 | A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about t… |
CVE-2023-36664 | High | 7.8 | 2023-06-25 | Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). |
CVE-2022-42834 | Low | 3.3 | 2023-06-23 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big Sur 11.7.3. An app m… |
CVE-2023-29931 | Critical | 9.8 | 2023-06-22 | laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php. |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
CVE-2023-2976 | Medium | 5.5 | 2023-06-14 | Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cr… |
CVE-2023-33568 | High | 7.5 | 2023-06-13 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppl… |
CVE-2023-32684 | Low | 2.7 | 2023-05-30 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk ima… |
CVE-2023-31066 | Critical | 9.1 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thro… |
CVE-2023-31064 | High | 7.5 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 thro… |
CVE-2022-45450 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) bef… |
CVE-2023-20184 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20183 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-2766 | Medium | 5.3 | 2023-05-17 | A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobi… |
CVE-2023-29820 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE… |
CVE-2023-29107 | Medium | 5.3 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1)… |
CVE-2023-27180 | High | 7.5 | 2023-04-07 | GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /_admin/backup.php. |
CVE-2023-1124 | High | 7.2 | 2023-04-03 | The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perfor… |
CVE-2023-28375 | High | 7.5 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. Using a GET parameter, attackers can disclose arbitrary files on the a… |
CVE-2023-25260 | High | 7.5 | 2023-03-28 | Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion. |
CVE-2023-23330 | High | 7.5 | 2023-03-28 | amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion. |
CVE-2023-1246 | High | 7.5 | 2023-03-10 | Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations. This issue affects… |
CVE-2023-26948 | High | 7.5 | 2023-03-09 | onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download. |
CVE-2023-26956 | High | 7.5 | 2023-03-08 | onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code. |
CVE-2023-22858 | Medium | 5.3 | 2023-03-06 | An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs. |
CVE-2023-22974 | High | 7.5 | 2023-02-22 | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-control… |
CVE-2023-0822 | High | 8.8 | 2023-02-17 | The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizatio… |
CVE-2022-44343 | High | 7.5 | 2023-02-06 | CRMEB 4.4.4 is vulnerable to Any File download. |
CVE-2022-48094 | Medium | 4.9 | 2023-02-01 | lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php. |
CVE-2022-48161 | High | 7.5 | 2023-02-01 | Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited vi… |
CVE-2022-47950 | Medium | 6.5 | 2023-01-18 | An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce th… |
CVE-2022-23508 | High | 8.8 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i… |
CVE-2022-45052 | High | 8.8 | 2023-01-04 | A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.ty… |
CVE-2022-4236 | Medium | 6.5 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available… |
CVE-2022-45426 | Medium | 6.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific cr… |
CVE-2022-28283 | Medium | 6.5 | 2022-12-22 | The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should… |
CVE-2022-4106 | High | 7.5 | 2022-12-19 | The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate… |
CVE-2022-45227 | High | 7.5 | 2022-12-12 | The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can b… |
CVE-2022-44356 | High | 7.5 | 2022-11-29 | WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated a… |
CVE-2022-3691 | High | 7.5 | 2022-11-21 | The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly acc… |
CVE-2022-44634 | Medium | 4.9 | 2022-11-18 | Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. |
CVE-2022-44583 | High | 7.5 | 2022-11-18 | Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. |
CVE-2022-45129 | High | 7.5 | 2022-11-10 | Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. Thi… |
CVE-2022-43449 | Medium | 6.2 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the… |
CVE-2022-41710 | Medium | 5.5 | 2022-11-03 | Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file th… |