Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2026-67402CRITICALAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual hoEPSS 0.5%CVE-2026-119757CRITICALBTCPay Server < 2.4.2 LND Macaroon Credential File DisclosureEPSS 0.5%CVE-2023-32226HIGH Sysaid - CWE-552: Files or Directories Accessible to External PartiesEPSS 0.5%CVE-2026-19903MEDIUMSourceCodester Online Clothing Store SQL Database Backup shopping.sql file accessEPSS 0.5%CVE-2026-78051MEDIUMalexta69 MeTube Cookie File cookies.txt file accessEPSS 0.5%CVE-2026-76799MEDIUMcode-projects Login Registration System SQL Database Backup login_registration_system.sql file accessEPSS 0.5%CVE-2024-0949CRITICALImproper Access Control in Talya Informatics' ElektrawebEPSS 0.5%CVE-2024-5045MEDIUMSourceCodester Online Birth Certificate Management System admin file accessEPSS 0.5%CVE-2026-53580HIGHTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureEPSS 0.5%CVE-2026-59703HIGHrepomix - Local File Inclusion via file:// URL Scheme in Git Clone EndpointEPSS 0.5%CVE-2024-2052HIGH CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltratEPSS 0.5%CVE-2024-49756MEDIUMAshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.EPSS 0.5%CVE-2024-6421HIGHPepperl+Fuchs: Incorrectly configured FTP-Server in OIT ProductsEPSS 0.5%CVE-2026-19987MEDIUMSourceCodester Best Employee Management System Profile exposure of information through directory listingEPSS 0.5%CVE-2025-15153MEDIUMPbootCMS SQLite Database pbootcms.db file accessEPSS 0.5%CVE-2024-3913MEDIUMPhoenix Contact: Start sequence allows attack during the boot processEPSS 0.5%CVE-2025-11965MEDIUMIn Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails toEPSS 0.5%CVE-2021-1256MEDIUMCisco Firepower Threat Defense Software Command File Overwrite VulnerabilityEPSS 0.5%CVE-2026-37065CRITICALVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.EPSS 0.5%CVE-2026-88623HIGHNUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is receiEPSS 0.5%