CVE-2024-33218

The CVE-2024-33218 entry concerns ASUSTeK Computer Inc.’s ASUS USB 3.0 Boost Storage Driver (version 5.30.20.0) and its AsUpIO64.sys component. The vulnerability allows attackers to escalate privileges and execute arbitrary code by sending crafted IOCTL requests, with local attack potential and h...

CVE-2023-52739 Fix page corruption caused by racy check in __free_pages

In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by racy check in freepages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c...

Memcyco Report: Just 6% of Brands Guard Against Digital Impersonation Fraud

By Waqas Memcyco Inc., a provider of digital trust technology designed to protect companies and their customers from digital impersonation… This is a post from HackRead.com Read the original post: Memcyco Report: Just 6% of Brands Guard Against Digital Impersonation Fraud...

CVE-2024-32809

Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41...

CVE-2024-32809 WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41...

CVE-2024-32809

CVE-2024-32809: WordPress ActiveDEMAND plugin (ActiveDEMAND) ≤ 0.2.41 suffers Unrestricted Upload of File with Dangerous Type, allowing unauthenticated file uploads and potential full compromise. CVSSv3.1 base score 10.0 (NETWORK, HIGH impact). Patch status indicates this was patched; upgrade to ...

CVE-2024-32131

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82...

CVE-2024-32131 WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82...

CVE-2024-32131 WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82...

CVE-2024-32131

CVE-2024-32131 describes an information disclosure in WordPress Download Manager (plugin). The vulnerability, titled Exposure of Sensitive Information to an Unauthorized Actor, allows a password-protected file lock bypass in versions up to 3.2.82 (includes 3.2.82). The CVSS v3.1 score is 7.5 (HIG...

CVE-2024-34567

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29...

CVE-2024-34567

CVE-2024-34567 describes a Stored Cross-Site Scripting (XSS) vulnerability in Popup Builder for WordPress, affecting the Popup Builder plugin up to version 1.1.29. The issue is caused by improper input neutralization during web page generation, enabling storedXSS by authenticated actors. Connecte...

CVE-2024-34567 WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29...

CVE-2024-34567 WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29...

CVE-2024-28042

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center...

CVE-2024-28042

CVE-2024-28042 relates to SUBNET PowerSYSTEM Center’s reliance on third‑party components. The vulnerability affects PowerSYSTEM Center prior to update 5.20.x.x, arising from untrusted third‑party libraries used by the product. Impact per CISA ICS advisory includes potential privilege escalation, ...

SUBNET PowerSYSTEM Center

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION : Low attack complexity Vendor : Subnet Solutions Inc. Equipment : PowerSYSTEM Center Vulnerabilities : Reliance on Insufficiently Trustworthy Component 2. RISK EVALUATION Successful exploitation of the vulnerabilities in components used by...

JVN#83405304: "OfferBox" App uses a hard-coded secret key

"OfferBox" App provided by i-plug inc. uses a hard-coded secret key for JWT CWE-321. Impact The hard-coded secret key for JWT may be retrieved if the application binary is reverse-engineered. Solution The hard-coded secret key has been revoked by the developer on May 8, 2024 therefore this...

CVE-2024-34564

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1...

CVE-2024-34564

CVE-2024-34564 is a Stored XSS in Counter Up (LogicHunt Inc.) via improper input neutralization during web page generation. Affected: Counter Up versions n/a–2.2.1. Root cause is improper neutralization of input; impact is Stored XSS. Connected Red Hat advisory confirms the description. Remediati...