Skip to content
OpenAdvisories

Weakness (CWE)

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Base Draft

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

How to prevent it (1 mitigation)

  1. Architecture and Design, Operation, System Configuration

    Do not expose file and directory information to the user.

Source: MITRE CWE-538

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-29114 Public exploit

    A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that…

    Dahua IPC
  • Medium 5.3
    CVE-2026-7071 Public exploit

    CodeAstro Online Job Portal user-cvs file information disclosure

    A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/user-cvs/. The manipulation leads to file and directory information exposure. Remote exploitation of t…

    CodeAstro Online Job Portal
  • Medium 5.3
    CVE-2024-51977 Public exploit EPSS 47%

    Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

    An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv ca…

    BROTHER INDUSTRIES DCP-L8410CDW MFC-L8690CDW MFC-L8610CDW
  • High 7.1
    CVE-2025-46820 Public exploit

    phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…

    phpgt Dom
  • Medium 6.5
    CVE-2019-15793 Public exploit

    Mishandling of file-system uid/gid with namespaces in shiftfs

    In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whe…

    Ubuntu Shiftfs in the Linux kernel linux-raspi2 linux-riscv Linux Ubuntu
  • Medium 5.3
    CVE-2017-9947 Public exploit

    A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V…