Full Path Disclosure

Home/Alerts/Alert detail/

Risk:
Low

Type:
Passive

CWE:
CWE-209

Summary: The full path of files which might be sensitive has been exposed to the client.

Solution: Disable directory browsing in your web server. Refer to the web server documentation.

References: https://owasp.org/www-community/attacks/Full_Path_Disclosure

Latest Security News

Anna Jaques Hospital ransomware breach exposed data of 300K patients

Ultralytics AI Library Compromised: Cryptocurrency Miner Found in PyPI Versions

Hackers Using Fake Video Conferencing Apps to Steal Web3 Professionals' Data

Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok

Microsoft expands Recall preview to Intel and AMD Copilot+ PCs

Ultralytics AI model hijacked to infect thousands with cryptominer

Blue Yonder SaaS giant breached by Termite ransomware gang

New Windows zero-day exposes NTLM credentials, gets unofficial patch

Common Alerts

InformationalUser Agent Fuzzer

HighPersonally Identifiable Information via WebSocket

LowInformation Disclosure - Sensitive Information in Browser sessionStorage

MediumBypassing 403

InformationalSession Management Response Identified

MediumInteger Overflow Error

InformationalCookie Slack Detector

InformationalSec-Fetch-Dest Header is Missing

InformationalInformation Disclosure - Suspicious Comments

HighSQL Injection - SQLite

Top CVE List

CVE-2024-11680 ProjectSend Improper Authentication Vulnerability

CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2024-51378 CyberPanel Incorrect Default Permissions Vulnerability

CVE-2024-7593 Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2021-26086 Atlassian Jira Server and Data Center Path Traversal Vulnerability

CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

CVE-2015-2360 Microsoft Win32k Privilege Escalation Vulnerability

CVE-2017-6316 Citrix Multiple Products Remote Code Execution Vulnerability

Common CWEs

CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages

HighCWE-798 Use of Hard-coded Credentials

MediumCWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

HighCWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

CWE-823 Use of Out-of-range Pointer Offset

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

HighCWE-129 Improper Validation of Array Index

CWE-522 Insufficiently Protected Credentials

CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments

Free security scan for your website

Don't show website scan report rating on the leaderboard