Advisories · Weakness
CWE-219.
Every Advisory and CVE whose sources give the weakness CWE-219, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
- Path traversal
- Code injection
<2.0.1 · fixed in 2.0.1
GHSA-g4c3-4g96-6g4m · CVE-2026-45140 - CVSS 4.2 Medium
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
- Information disclosure
- CWE-215
<25.11.0 · fixed in 25.11.0
GHSA-xvp7-8vm8-xfxx - CVSS 7.8 High
Astro's server source code is exposed to the public if sourcemaps are enabled
- CWE-219
<4.16.18 || >=5.0.0-alpha.0, <5.0.8 · fixed in 4.16.18, 5.0.8
GHSA-49w6-73cw-chjr · CVE-2024-56159 - CVSS 8.7 High
Avtec Outpost Storage of File with Sensitive Data Under Web Root
- Avtec Outpost 0810
- Avtec Outpost Uploader Utility
- CWE-219
- CVSS 5.3 Medium
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability
- Triangle MicroWorks SCADA Data Gateway
- CWE-219
-
Airspan AirVelocity: An authenticated attacker can enumerate and download sensitive files…
- Airspan AirVelocity
- CWE-219
- CVSS 8.1 High
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102.
- CWE-219
- CVSS 5.3 Medium
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap…
- CWE-219