CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11104 – Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
https://notcve.org/view.php?id=CVE-2024-11104
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. • https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267 https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1290 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189030%40sky-elementor-addons&new=3189030%40sky-elementor-addons&sfp_email=&sfph_mail= https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193495%40sky-elementor-addons&new=3193495%40sky-ele • CWE-862: Missing Authorization •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52581 – Litestar allows unbounded resource consumption (DoS vulnerability)
https://notcve.org/view.php?id=CVE-2024-52581
Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. ... The multipart form parser in affected versions is vulnerable to this type of attack by design. ... This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. • https://github.com/litestar-org/litestar/blob/main/litestar/_multipart.py#L97 https://github.com/litestar-org/litestar/commit/53c1473b5ff7502816a9a339ffc90731bb0c2138 https://github.com/litestar-org/litestar/security/advisories/GHSA-gjcc-jvgw-wvwj https://github.com/litestar-org/litestar/security/advisories/GHSA-p24m-863f-fm6q) https://github.com/litestar-org/litestar/security/advisories/GHSA-p24m-863f-fm6q • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-9487
https://notcve.org/view.php?id=CVE-2018-9487
In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check. This could lead to local denial of service with no additional execution privileges needed. • https://source.android.com/security/bulletin/2018-09-01 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52796 – Password Pusher's rate limiter can be bypassed by forging proxy headers
https://notcve.org/view.php?id=CVE-2024-52796
In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. • https://docs.pwpush.com/docs/proxies/#trusted-proxies https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0 https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52598 – 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview
https://notcve.org/view.php?id=CVE-2024-52598
The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. ... The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. ... Version 5.4.1 fixes the issues. 2FAuth es una aplicación web para administrar cuentas de autenticación de dos factores (2FA) y generar sus códigos de seguridad. Existen dos vulnerabilidades interconectadas en la versión 5.4.1: un problema de omisión de validación de SSRF y URI. ... La combinación de estos dos problemas permite a un atacante recuperar URI accesibles desde la aplicación, siempre que su tipo de contenido esté basado en texto. • https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-918: Server-Side Request Forgery (SSRF) •