Common Weakness Enumeration
CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
699 vulnerabilities reference this CWE, most recent first.
GHSA-54MQ-99QQ-7HR5
Vulnerability from github – Published: 2025-05-28 18:33 – Updated: 2025-10-22 00:33
VLAI
Details
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48928"
],
"database_specific": {
"cwe_ids": [
"CWE-528",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-28T17:15:25Z",
"severity": "MODERATE"
},
"details": "The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.",
"id": "GHSA-54mq-99qq-7hr5",
"modified": "2025-10-22T00:33:18Z",
"published": "2025-05-28T18:33:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48928"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48928"
},
{
"type": "WEB",
"url": "https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5553-RF4F-G9QC
Vulnerability from github – Published: 2025-02-24 15:30 – Updated: 2026-06-01 15:30
VLAI
Details
Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse.This issue affects Health4All: before 10.01.2025.
Severity
8.3 (High)
{
"affected": [],
"aliases": [
"CVE-2024-12917"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-24T15:15:12Z",
"severity": "HIGH"
},
"details": "Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse.This issue affects Health4All: before 10.01.2025.",
"id": "GHSA-5553-rf4f-g9qc",
"modified": "2026-06-01T15:30:32Z",
"published": "2025-02-24T15:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12917"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0042"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0042"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-56QR-6HFH-52CG
Vulnerability from github – Published: 2022-05-21 00:00 – Updated: 2022-06-03 00:00
VLAI
Details
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2022-29447"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-20T21:15:00Z",
"severity": "HIGH"
},
"details": "Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company\u0027s Hover Effects plugin \u003c= 2.1 at WordPress.",
"id": "GHSA-56qr-6hfh-52cg",
"modified": "2022-06-03T00:00:57Z",
"published": "2022-05-21T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29447"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/hover-effects/wordpress-hover-effects-plugin-2-1-authenticated-local-file-inclusion-lfi-vulnerability"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/hover-effects/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-57GH-M6RQ-54CF
Vulnerability from github – Published: 2026-04-03 02:53 – Updated: 2026-04-03 02:53
VLAI
Summary
OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
Details
Summary
Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
1ca4261d7e055d0be141ed79ebb1365d0fbc7364— 2026-03-30T17:15:03+01:00
OpenClaw thanks @tdjackey for reporting.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.28"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-03T02:53:58Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nMedia Local Roots Self-Whitelisting in `appendLocalMediaParentRoots` Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration\n\n## Current Maintainer Triage\n- Status: narrow\n- Normalized severity: medium\n- Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `1ca4261d7e055d0be141ed79ebb1365d0fbc7364` \u2014 2026-03-30T17:15:03+01:00\n\nOpenClaw thanks @tdjackey for reporting.",
"id": "GHSA-57gh-m6rq-54cf",
"modified": "2026-04-03T02:53:58Z",
"published": "2026-04-03T02:53:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-57gh-m6rq-54cf"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/1ca4261d7e055d0be141ed79ebb1365d0fbc7364"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read \u0026 Credential Exfiltration"
}
GHSA-5824-6JFV-XR3R
Vulnerability from github – Published: 2022-05-26 00:01 – Updated: 2022-06-09 22:55
VLAI
Summary
Arbitrary file read in ginadmin
Details
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A patch is available on the master branch of the repository.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gphper/ginadmin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-30428"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-01T21:12:49Z",
"nvd_published_at": "2022-05-25T16:15:00Z",
"severity": "HIGH"
},
"details": "In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A [patch](https://github.com/gphper/ginadmin/commit/726109f01ad23523715f36f7d272958064666a30) is available on the `master` branch of the repository.",
"id": "GHSA-5824-6jfv-xr3r",
"modified": "2022-06-09T22:55:49Z",
"published": "2022-05-26T00:01:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30428"
},
{
"type": "WEB",
"url": "https://github.com/gphper/ginadmin/issues/9"
},
{
"type": "WEB",
"url": "https://github.com/gphper/ginadmin/commit/726109f01ad23523715f36f7d272958064666a30"
},
{
"type": "PACKAGE",
"url": "github.com/gphper/ginadmin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary file read in ginadmin"
}
GHSA-58F3-CX8P-H8JG
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2024-04-23 22:30
VLAI
Summary
Drupal core access bypass vulnerability
Details
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.56"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.56"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-6922"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:30:57Z",
"nvd_published_at": "2019-01-22T15:29:00Z",
"severity": "MODERATE"
},
"details": "In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.",
"id": "GHSA-58f3-cx8p-h8jg",
"modified": "2024-04-23T22:30:57Z",
"published": "2022-05-13T01:36:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6922"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3897"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2017-003"
},
{
"type": "WEB",
"url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99219"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038781"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Drupal core access bypass vulnerability"
}
GHSA-58W9-H6F7-F979
Vulnerability from github – Published: 2022-08-24 00:00 – Updated: 2022-08-31 00:00
VLAI
Details
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-3800"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-23T16:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.",
"id": "GHSA-58w9-h6f7-f979",
"modified": "2022-08-31T00:00:21Z",
"published": "2022-08-24T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3800"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3800"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1938284"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/glib/-/commit/3529bb4450a51995"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00020.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221028-0004"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2017/06/23/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59G4-HPG3-3GCP
Vulnerability from github – Published: 2021-12-14 21:44 – Updated: 2022-01-04 18:53
VLAI
Summary
Files Accessible to External Parties in Opencast
Details
Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface.
Impact
Before Opencast 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine.
For example, to expose the custom.properties of develop.opencast.org via the asset manager, an attacker could have run:
curl -f -i -u admin:opencast \
https://develop.opencast.org/ingest/addMediaPackage/fast \
-F 'flavor=presenter/source'\
-F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
-F title="custom.properties"
An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given.
Patches
The issue has been fixed in Opencast 10.6 and 11.0.
Workarounds
You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
References
For more information
If you have any questions or comments about this advisory: * Open an issue in our issue tracker * Email us at security@opencast.org
Severity
9.9 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opencastproject:opencast-ingest-service-impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-43821"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-14T19:29:54Z",
"nvd_published_at": "2021-12-14T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast\u0027s host machines and making them available via the web interface.\n\n### Impact\n\nBefore Opencast 10.6, Opencast would [open and include local files during ingests](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587). Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine.\n\nFor example, to expose the `custom.properties` of develop.opencast.org via the asset manager, an attacker could have run:\n\n```\ncurl -f -i -u admin:opencast \\\n https://develop.opencast.org/ingest/addMediaPackage/fast \\\n -F \u0027flavor=presenter/source\u0027\\\n -F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\\\n -F title=\"custom.properties\" \n```\n\nAn attacker would need to have the privileges required to add new media to exploit this. But these are often widely given.\n\n\n### Patches\n\nThe issue has been fixed in Opencast 10.6 and 11.0.\n\n### Workarounds\n\nYou can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.\n\n### References\n\n- [Example of problematic code](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587).\n- [Patch fixing the issue](https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)\n* Email us at [security@opencast.org](mailto:security@opencast.org)\n",
"id": "GHSA-59g4-hpg3-3gcp",
"modified": "2022-01-04T18:53:43Z",
"published": "2021-12-14T21:44:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/opencast/opencast/security/advisories/GHSA-59g4-hpg3-3gcp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43821"
},
{
"type": "WEB",
"url": "https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencast/opencast"
},
{
"type": "WEB",
"url": "https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587"
},
{
"type": "WEB",
"url": "https://mvnrepository.com/artifact/org.opencastproject/opencast-ingest-service-impl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Files Accessible to External Parties in Opencast"
}
GHSA-59W9-V72G-J4RG
Vulnerability from github – Published: 2022-11-29 18:30 – Updated: 2022-12-02 15:30
VLAI
Details
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-44356"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-29T17:15:00Z",
"severity": "HIGH"
},
"details": "WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.",
"id": "GHSA-59w9-v72g-j4rg",
"modified": "2022-12-02T15:30:26Z",
"published": "2022-11-29T18:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44356"
},
{
"type": "WEB",
"url": "https://github.com/strik3r0x1/Vulns/blob/main/Wavlink%20WL-WN531G3.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5CQ6-9F97-WJWX
Vulnerability from github – Published: 2026-05-16 00:31 – Updated: 2026-05-16 03:31
VLAI
Details
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
{
"affected": [],
"aliases": [
"CVE-2026-8704"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-15T23:16:21Z",
"severity": null
},
"details": "Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.",
"id": "GHSA-5cq6-9f97-wjwx",
"modified": "2026-05-16T03:31:27Z",
"published": "2026-05-16T00:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8704"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19#lib/Crypt/DSA/Key.pm"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/15/27"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.