CWE-219 · 6 records

Storage of File with Sensitive Data Under Web Root

CVEs in this class

6 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2024-39776No exploit	Avtec Outpost Storage of File with Sensitive Data Under Web Rootavtecinc · outpost uploader utility · CWE-219 Pre-auth	High8.7	—	0.3%	Aug 22, 2024
31Monitor	CVE-2022-21236No exploit	An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102.reolink · rlc-410w firmware · CWE-219 Pre-auth	High7.5	—	1.8%	Jan 28, 2022
31Monitor	CVE-2024-56159Proof of concept	Server source code is exposed to the public if sourcemaps are enabledastro · astro · CWE-219 Pre-auth	High7.8	—	1.5%	Dec 19, 2024
26Monitor	CVE-2022-36306No exploit	An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web seairspan · airvelocity 1500 firmware · CWE-219	Medium6.5	—	0.9%	Aug 15, 2022
22Monitor	CVE-2002-2024No exploit	Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reasohorde · imp · CWE-219 Pre-auth	Medium5.3	—	1.9%	Dec 31, 2002
21Monitor	CVE-2023-39467No exploit	Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerabilitytrianglemicroworks · scada data gateway · CWE-219 Pre-auth	Medium5.3	—	0.5%	May 2, 2024

CVE-2024-39776
34Monitor
Avtec Outpost Storage of File with Sensitive Data Under Web Root
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
avtecinc · outpost uploader utilityAug 22, 2024
CVE-2022-21236
31Monitor
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
reolink · rlc-410w firmwareJan 28, 2022
CVE-2024-56159
31Monitor
Server source code is exposed to the public if sourcemaps are enabled
HighCVSS 7.8Proof of conceptEPSS 1%
- Pre-auth
astro · astroDec 19, 2024
CVE-2022-36306
26Monitor
An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web se
MediumCVSS 6.5No exploitEPSS 0%
airspan · airvelocity 1500 firmwareAug 15, 2022
CVE-2002-2024
22Monitor
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reaso
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
horde · impDec 31, 2002
CVE-2023-39467
21Monitor
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
trianglemicroworks · scada data gatewayMay 2, 2024