CVSS: 2.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36032 – Bluetooth: qca: fix info leak when fetching fw build id
https://notcve.org/view.php?id=CVE-2024-36032
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed. • https://git.kernel.org/stable/c/c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488 https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1 https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2 •
CVSS: 4.0EPSS: 0%CPEs: -EXPL: 0CVE-2022-43841 – IBM Aspera Console information disclosure
https://notcve.org/view.php?id=CVE-2022-43841
IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 239078. IBM Aspera Console 3.4.0 a 3.4.2 PL9 permite almacenar páginas web localmente que otro usuario del sistema puede leer. ID de IBM X-Force: 239078. • https://exchange.xforce.ibmcloud.com/vulnerabilities/239078 https://www.ibm.com/support/pages/node/7155202 • CWE-525: Use of Web Browser Cache Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4205 – Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure
https://notcve.org/view.php?id=CVE-2024-4205
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content() function in all versions up to, and including, 4.10.31. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve Elementor template data. El complemento Premium Addons for Elementor para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la función get_template_content() en todas las versiones hasta la 4.10.31 incluida. Esto hace posible que los atacantes autenticados, con acceso a nivel de suscriptor y superior, recuperen datos de la plantilla de Elementor. • https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.28/includes/addons-integration.php#L1408 https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/includes/addons-integration.php https://www.wordfence.com/threat-intel/vulnerabilities/id/175cb977-dcba-429f-814c-6de078e23472?source=cve • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-36107 – Information disclosure in minio
https://notcve.org/view.php?id=CVE-2024-36107
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272 https://github.com/minio/minio/pull/19810 https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.6EPSS: 93%CPEs: 16EXPL: 51CVE-2024-24919 – Check Point Quantum Security Gateways Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-24919
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. ... Check Point Security Gateway suffers from an information disclosure vulnerability. ... Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. • https://github.com/verylazytech/CVE-2024-24919 https://github.com/RevoltSecurities/CVE-2024-24919 https://github.com/seed1337/CVE-2024-24919-POC https://github.com/GoatSecurity/CVE-2024-24919 https://github.com/LucasKatashi/CVE-2024-24919 https://github.com/emanueldosreis/CVE-2024-24919 https://github.com/Rug4lo/CVE-2024-24919-Exploit https://github.com/zam89/CVE-2024-24919 https://github.com/GlobalsecureAcademy/CVE-2024-24919 https://github.com/r4p3c4/CVE-2024-24919-Exploit-PoC- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •