Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2026-65210MEDIUMSupermicro BMC IPMI feature contains Arbitrary File Access vulnerabilityEPSS 0.2%CVE-2026-100727MEDIUMAn improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pageEPSS 0.2%CVE-2021-1512MEDIUMCisco SD-WAN Software Arbitrary File Corruption VulnerabilityEPSS 0.2%CVE-2026-67073HIGHHCL BigFix AEX is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-23421MEDIUMQardio iOS and Android applications Files or Directories Accessible to External PartiesEPSS 0.2%CVE-2026-90627MEDIUMApache OpenOffice: Local file inclusion via SQL provider and flat file database referencesEPSS 0.2%CVE-2026-90632—Apache OpenOffice: Local file inclusion via GStreamer pluginEPSS 0.2%CVE-2025-4134HIGHLack of file validation in Avast Business Antivirus for Linux allows writing untrusted update filesEPSS 0.2%CVE-2026-75889HIGHCVE-2026-75889 CVE RecordEPSS 0.2%CVE-2026-7817HIGHpgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpointsEPSS 0.2%CVE-2026-89118MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2026-119201MEDIUMNuxt dev server exposes generated appSecret through Vite file servingEPSS 0.2%CVE-2023-31017HIGHCVEEPSS 0.2%CVE-2023-20039MEDIUMCisco Industrial Network Director File PermissionsEPSS 0.2%CVE-2025-44779MEDIUMAn issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.EPSS 0.2%CVE-2026-65983HIGHOpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootEPSS 0.2%CVE-2025-23276HIGHNVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulEPSS 0.2%CVE-2021-47960MEDIUMA files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to EPSS 0.2%CVE-2025-30103MEDIUMDell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A lEPSS 0.2%CVE-2025-49797HIGHMultiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be execuEPSS 0.2%