cve.bz

CWE-552: Files or Directories Accessible to External Parties, page 5

Filter

The product makes files or directories accessible to unauthorized actors, even though they should not be.

What the weakness is: CWE-552 at MITRE

Ask an AI about CWE-552

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-552: Files or Directories Accessible to External Parties and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/552.html and https://cve.bz/cve/cwe/552?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2024-45627EPSS 0.3%

    In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis serve…

  2. 7.1CVE-2024-53649EPSS 0.6%

    A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6MD89 (CP300) (All versi…

  3. 7.6CVE-2024-47518EPSS 0.4%

    Specially constructed queries targeting ETM could discover active remote access sessions

  4. 7.1CVE-2024-43660EPSS 0.6%

    The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The scri…

  5. 8.7CVE-2025-21609EPSS 0.6%

    SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attac…

  6. 8.8CVE-2024-52047EPSS 1.1%

    A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code…

  7. 5.3CVE-2024-9945EPSS 0.3%

    An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.

  8. 7.1CVE-2024-54099EPSS 0.1%

    File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

  9. 8.8CVE-2024-50627EPSS 0.3%

    An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malici…

  10. 8.8CVE-2024-51542EPSS 0.3%

    Configuration Download vulnerabilities allow access to dependency configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

  11. 9.8CVE-2024-53676EPSS 56%

    A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

  12. 6.2CVE-2024-51058EPSS 0.8%

    Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.

  13. 5.9CVE-2024-10403EPSS 0.7%

    Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core …

  14. 5.3CVE-2024-10126EPSS 0.4%

    Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.

  15. 6.5CVE-2024-31141EPSS 1.3%

    Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in orde…

  16. 5.5CVE-2023-20039EPSS 0.2%

    A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficient default file permissions that are applied to the application data directory. An attacker could…

  17. 6.5CVE-2024-52292EPSS 0.7%

    Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it…

  18. 5.8CVE-2024-8535EPSS 0.4%

    Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to acce…

  19. 3.3CVE-2024-48838EPSS 0.2%

    Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this v…

  20. 8.6CVE-2024-10526EPSS 0.2%

    Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to…

  21. 7.2CVE-2024-48647EPSS 0.8%

    A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. The attacker can exploit t…

  22. 7.5CVE-2024-49359EPSS 1.0%

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traver…

  23. 5.3CVE-2024-49756EPSS 0.5%

    AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only …

  24. 5.3CVE-2024-44807EPSS 0.5%

    A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.

  25. 4.9CVE-2024-45894EPSS 0.3%

    BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.

  26. 6.8CVE-2024-7107EPSS 0.3%

    Files or Directories Accessible to External Parties vulnerability in National Keep Cyber Security Services CyberMath allows Collect Data from Common Resource Locations. This issue affects CyberMath: before CYBM.240816253.

  27. 9.2CVE-2024-6878EPSS 0.4%

    Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affects Panel: before v2.3.24.

  28. 6.9CVE-2024-8655EPSS 0.5%

    A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The manipulation leads to files or directories accessible. It is possible to initia…

  29. 9.8CVE-2024-39581EPSS 0.4%

    Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to read, modify, …

  30. 8.8CVE-2024-36442EPSS 0.7%

    cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system.

  31. 7.5CVE-2023-49198EPSS 0.9%

    Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPac…

  32. 7.5CVE-2024-41699EPSS 0.3%

    Priority – CWE-552: Files or Directories Accessible to External Parties

  33. 7.5CVE-2024-7729EPSS 0.6%

    The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.

  34. 5.9CVE-2024-3913EPSS 0.5%

    An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.

  35. 8.5CVE-2024-38876EPSS 0.2%

    A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (…

  36. 4.9CVE-2024-27182EPSS 0.7%

    In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, whi…

  37. 7.5CVE-2024-38429EPSS 0.4%

    Matrix Tafnit v8 -  CWE-552: Files or Directories Accessible to External Parties

  38. 6.5CVE-2024-40767EPSS 0.9%

    In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user …

  39. 8.7CVE-2024-6911ExploitEPSS 4.9%

    Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.

  40. 6.5CVE-2023-41916EPSS 0.7%

    In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the M…

  41. 7.5CVE-2024-6421EPSS 0.5%

    An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service.

  42. 9.4CVE-2024-6209ExploitEPSS 17%

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

  43. 6.5CVE-2024-32498EPSS 0.8%

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data fi…

  44. 9.9CVE-2024-39931EPSS 53%

    Gogs through 0.13.0 allows deletion of internal files.

  45. 7.5CVE-2024-4836ExploitEPSS 2.6%

    Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in r…

  46. 9.8CVE-2024-0949EPSS 0.5%

    Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.

  47. 9.8CVE-2024-4098EPSS 1.0%

    The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary f…

  48. 6.5CVE-2024-5056EPSS 0.4%

    CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the fil…

  49. 5.5CVE-2024-23282EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A maliciously crafted email may be able to initiate FaceTime calls without user a…

  50. 9.3CVE-2024-5262EPSS 0.6%

    Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server v…