CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
baseThe product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (131)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-15793US | high8.8OT high | Exploit | ||
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing… | ||||
| CVE-2006-5316US | high7.8 | Exploit | ||
registroTL stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for /usuarios… | ||||
| CVE-2019-6851US | high7.5 | — | ||
A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause… | ||||
| CVE-2025-11079US | critical9.8 | — | ||
A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this issue is some unknown functionality. The manipulation results in file and directory in… | ||||
| CVE-2024-22433US | critical9.8 | — | ||
Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauth… | ||||
| CVE-2021-3528US | high8.8 | — | ||
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker w… | ||||
| CVE-2017-9947US | medium5.3 | Exploit | ||
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote… | ||||
| CVE-2007-2979US | high7.8 | — | ||
Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databa… | ||||
| CVE-2022-4318US | high7.8 | — | ||
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. | ||||
| CVE-2022-23508US | high7.8 | — | ||
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could al… | ||||
| CVE-2021-40363US | high7.8OT elevated | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and ear… | ||||
| CVE-2019-14846US | high7.8 | — | ||
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of cred… | ||||
| CVE-2018-10590US | high7.5 | — | ||
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior t… | ||||
| CVE-2005-1900US | high7.5 | — | ||
Sawmill before 7.1.6 allows remote attackers to bypass authentication and (1) gain administrative privileges or (2) add a license. | ||||
| CVE-2023-46723US | high7.5 | — | ||
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The s… | ||||
| CVE-2023-28444US | high7.5 | — | ||
angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configurat… | ||||
| CVE-2022-44623US | high7.5 | — | ||
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings | ||||
| CVE-2022-31098US | high7.5 | — | ||
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave… | ||||
| CVE-2021-45421US | high7.5 | — | ||
Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the rem… | ||||
| CVE-2020-7506US | high7.5 | — | ||
A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive with the firmware for t… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan