CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27231
https://notcve.org/view.php?id=CVE-2024-27231
This could lead to local information disclosure with no additional execution privileges needed. • https://source.android.com/security/bulletin/pixel/2024-04-01 •
CVSS: 5.3EPSS: 7%CPEs: 1EXPL: 1CVE-2024-3097 – WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
https://notcve.org/view.php?id=CVE-2024-3097
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin. El complemento WordPress Gallery Plugin – NextGEN Gallery para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la función get_item en versiones hasta la 3.59 incluida. Esto hace posible que atacantes no autenticados extraigan datos confidenciales, incluidos EXIF y otros metadatos de cualquier imagen cargada a través del complemento. • https://github.com/Athos-Zago/CVE-2024-30973 https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/REST/Admin/Block.php#L40 https://plugins.trac.wordpress.org/changeset/3063940/nextgen-gallery/trunk/src/REST/Admin/Block.php?old=3003333&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FREST%2FAdmin%2FBlock.php https://www.wordfence.com/threat-intel/vulnerabilities/id/75f87f99-9f0d-46c2-a6f1-3c1ea0176303?source=cve https://zpbrent.github.io/pocs/8-plugin-nextgen-gallery-InfoDis-20240327.mp4 • CWE-862: Missing Authorization •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2023-6522 – Information Disclosure in ExtremePacs's Extreme XDS
https://notcve.org/view.php?id=CVE-2023-6522
Improper Privilege Management vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914. Una vulnerabilidad de gestión de privilegios inadecuada en ExtremePacs Extreme XDS permite recopilar datos proporcionados por los usuarios. Este problema afecta a Extreme XDS: antes de 3914. Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914. • https://www.usom.gov.tr/bildirim/tr-24-0276 • CWE-269: Improper Privilege Management CWE-648: Incorrect Use of Privileged APIs •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31302 – WordPress Contact Form Email plugin <= 1.3.44 - Sensitive Data Exposure vulnerability
https://notcve.org/view.php?id=CVE-2024-31302
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44. ... The Contact Form Email plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.44 via log files. • https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-44-sensitive-data-exposure-vulnerability? • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31298 – WordPress User Spam Remover plugin <= 1.0 - Sensitive Data Exposure via Log File vulnerability
https://notcve.org/view.php?id=CVE-2024-31298
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0. The User Spam Remover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 via a log file. • https://patchstack.com/database/vulnerability/user-spam-remover/wordpress-user-spam-remover-plugin-1-0-sensitive-data-exposure-via-log-file-vulnerability? • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •