CVSS: 5.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-36107 – Information disclosure in minio
https://notcve.org/view.php?id=CVE-2024-36107
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. • https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272 https://github.com/minio/minio/pull/19810 https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.6EPSS: 93%CPEs: 16EXPL: 51CVE-2024-24919 – Check Point Quantum Security Gateways Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-24919
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. ... Check Point Security Gateway suffers from an information disclosure vulnerability. ... Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. • https://github.com/verylazytech/CVE-2024-24919 https://github.com/RevoltSecurities/CVE-2024-24919 https://github.com/seed1337/CVE-2024-24919-POC https://github.com/GoatSecurity/CVE-2024-24919 https://github.com/LucasKatashi/CVE-2024-24919 https://github.com/emanueldosreis/CVE-2024-24919 https://github.com/Rug4lo/CVE-2024-24919-Exploit https://github.com/zam89/CVE-2024-24919 https://github.com/GlobalsecureAcademy/CVE-2024-24919 https://github.com/r4p3c4/CVE-2024-24919-Exploit-PoC- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23315
https://notcve.org/view.php?id=CVE-2024-23315
A specially crafted network packet can lead to a disclosure of sensitive information. • https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003yZ72AI/sa00037 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1941 https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1941 • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4429 – Cross Site Request Forgery vulnerability in iManager
https://notcve.org/view.php?id=CVE-2024-4429
This could lead to sensitive information disclosure. • https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2024-5354 – anji-plus AJ-Report detailByCode information disclosure
https://notcve.org/view.php?id=CVE-2024-5354
The manipulation of the argument shareToken leads to information disclosure. ... Dank der Manipulation des Arguments shareToken mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. • https://github.com/anji-plus/report/files/15363269/aj-report.pdf https://github.com/anji-plus/report/issues/34 https://vuldb.com/?ctiid.266266 https://vuldb.com/?id.266266 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •