Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2023-4475HIGHAn Arbitrary File Movement vulnerability was found on the ADMEPSS 0.2%CVE-2023-29820MEDIUMAn issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive infoEPSS 0.2%CVE-2024-10526HIGHRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceEPSS 0.2%CVE-2023-29080HIGHPrivilege escalation in InstallShieldEPSS 0.2%CVE-2025-13225MEDIUMTanium addressed an arbitrary file deletion vulnerability in TanOS.EPSS 0.2%CVE-2025-59054HIGHdstack has insecure LUKS2 persistent storage partitions that may be opened and usedEPSS 0.2%CVE-2025-25267MEDIUMA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (AllEPSS 0.2%CVE-2026-35169HIGHLORIS has potential cross-site scripting in help_editor moduleEPSS 0.2%CVE-2025-25266HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (AllEPSS 0.2%CVE-2024-48838LOWDell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External EPSS 0.2%CVE-2025-3025HIGHCCleaner Link Following Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2025-69875HIGHA vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore pEPSS 0.1%CVE-2024-54099MEDIUMFile replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentialiEPSS 0.1%CVE-2026-6544MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.1%CVE-2024-11399MEDIUMFiles or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13EPSS 0.1%CVE-2026-15915MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.1%CVE-2025-15065HIGHData Exposure in Kings Information & Network KESS EnterpriseEPSS 0.1%CVE-2026-123988MEDIUMSililaWijesinghe Food Ordering System admin exposure of information through directory listingEPSS —