CVE-2025-21745

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @blockclass's subsystem refcount leakage blkcgfillrootiostats iterates over @blockclass's devices by classdeviterinit|next, but does not end iterating with classdeviterexit, so causes the class's subsystem...

CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...

CVE-2024-1561

An issue was discovered in gradio-app/gradio, where the "/componentserver" endpoint improperly allows the invocation of any method on a "Component" class with attacker-controlled arguments. Specifically, by exploiting the "moveresourcetoblockcache" method of the "Block" class, an attacker can cop...

[SECURITY] Fedora 22 Update: drupal7-block_class-2.3-1.fc22

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

[SECURITY] Fedora 23 Update: drupal7-block_class-2.3-1.fc23

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

Fedora 22 : drupal7-block_class-2.3-1.fc22 (2016-8d983eeb13)

7.x-2.3 The security update 2.2 broke very common class names, see 2636548: upgrade to 2.2 converts class underscore to dash. 7.x-2.2 Fixes Block Class- Critical - Cross Site Scripting XSS - SA- CONTRIB-2015-175 Note that Tenable Network Security has extracted the preceding description block...

Fedora 24 : drupal7-block_class-2.3-1.fc24 (2016-687b3a3d5d)

7.x-2.3 The security update 2.2 broke very common class names, see 2636548: upgrade to 2.2 converts class underscore to dash. 7.x-2.2 Fixes Block Class- Critical - Cross Site Scripting XSS - SA- CONTRIB-2015-175 Note that Tenable Network Security has extracted the preceding description block...

Drupal Block Class module cross-site scripting vulnerability (CNVD-2016-02374)

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . Drupal Block Class module 7.x-2.2 before the 7.x-2.x version of a...

[SECURITY] Fedora 24 Update: drupal7-block_class-2.3-1.fc24

Block Class allows users to add classes to any block through the block's configuration interface. By adding a very short snippet of PHP to a theme's block.tpl.php file, classes can be added to the parent element of a block. This package provides the following Drupal module: blockclass...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

Cross site scripting

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

CVE-2016-3144

CVE-2016-3144 affects the Drupal Block Class module (7.x-2.x) with remote XSS via a crafted class name when an attacker has Administer block classes permission. Root cause: improper handling of class names in 7.x-2.x prior to 7.x-2.2, enabling injection of script/HTML. Impact: cross-site scriptin...

PT-2016-5384

Name of the Vulnerable Software and Affected Versions Drupal Block Class module versions 7.x-2.x before 7.x-2.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a clas...

CVE-2016-3144: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

Drupal Block Class Module HTML Injection Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . An HTML injection vulnerability exists in Drupal Block Class modul...

Block Class - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-175

This module enables you to add custom classes to blocks. The module doesn't sufficiently scrub class names written by a malicious block class administrator. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer block classes". CVE identifier...

CVE-2012-1657

Cross-site scripting XSS vulnerability in blockclass.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name...

Cross site scripting

Cross-site scripting XSS vulnerability in blockclass.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name...

CVE-2012-1657

The CVE-2012-1657 issue affects the Drupal Block Class module (Block Class) for Drupal 7.x prior to 7.x-1.1. The root cause is improper filtering of class names in the block configuration, enabling remote authenticated users with certain permissions to inject arbitrary web script or HTML via the ...