CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4205 – Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure
https://notcve.org/view.php?id=CVE-2024-4205
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content() function in all versions up to, and including, 4.10.31. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve Elementor template data. El complemento Premium Addons for Elementor para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la función get_template_content() en todas las versiones hasta la 4.10.31 incluida. Esto hace posible que los atacantes autenticados, con acceso a nivel de suscriptor y superior, recuperen datos de la plantilla de Elementor. • https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.28/includes/addons-integration.php#L1408 https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/includes/addons-integration.php https://www.wordfence.com/threat-intel/vulnerabilities/id/175cb977-dcba-429f-814c-6de078e23472?source=cve • CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36114 – Decompressors can crash the JVM and leak memory content in Aircompressor
https://notcve.org/view.php?id=CVE-2024-36114
All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). ... When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. • https://github.com/airlift/aircompressor/commit/15e68df9eb0c2bfde7f796231ee7cd1982965071 https://github.com/airlift/aircompressor/commit/2cea90a45534f9aacbb77426fb64e975504dee6e https://github.com/airlift/aircompressor/commit/cf66151541edb062ea88b6f3baab3f95e48b7b7f https://github.com/airlift/aircompressor/commit/d01ecb779375a092d00e224abe7869cdf49ddc3e https://github.com/airlift/aircompressor/security/advisories/GHSA-973x-65j7-xcf4 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-36107 – Information disclosure in minio
https://notcve.org/view.php?id=CVE-2024-36107
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272 https://github.com/minio/minio/pull/19810 https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.6EPSS: 93%CPEs: 16EXPL: 51CVE-2024-24919 – Check Point Quantum Security Gateways Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-24919
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. ... Check Point Security Gateway suffers from an information disclosure vulnerability. ... Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. • https://github.com/verylazytech/CVE-2024-24919 https://github.com/RevoltSecurities/CVE-2024-24919 https://github.com/seed1337/CVE-2024-24919-POC https://github.com/GoatSecurity/CVE-2024-24919 https://github.com/LucasKatashi/CVE-2024-24919 https://github.com/emanueldosreis/CVE-2024-24919 https://github.com/Rug4lo/CVE-2024-24919-Exploit https://github.com/zam89/CVE-2024-24919 https://github.com/GlobalsecureAcademy/CVE-2024-24919 https://github.com/r4p3c4/CVE-2024-24919-Exploit-PoC- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4429 – Cross Site Request Forgery vulnerability in iManager
https://notcve.org/view.php?id=CVE-2024-4429
This could lead to sensitive information disclosure. • https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html • CWE-352: Cross-Site Request Forgery (CSRF) •