CVE-2017-20090: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

Malicious code in mcs-landings-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 606f5b2317ff6cd1f2790d17da4c7d09b4e2b864a76f7f7a184e8c92fcf8ae59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in newspack-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19d89b9d3f2015dea066768f0f4932002b56fe3f15314f22cd1624289d77e654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4821 Malicious code in newspack-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19d89b9d3f2015dea066768f0f4932002b56fe3f15314f22cd1624289d77e654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in page-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b34f0384ae5c4174f21aa87a140a1c67dbbfa56d22ec198c231d07c6a28edb66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5189 Malicious code in page-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b34f0384ae5c4174f21aa87a140a1c67dbbfa56d22ec198c231d07c6a28edb66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1622 Malicious code in blocks-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56aa6e61ddb94ea4a56ee9d895d73d3be13dd9ebf1d7b5ae3343d24a963d9c9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blocks-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56aa6e61ddb94ea4a56ee9d895d73d3be13dd9ebf1d7b5ae3343d24a963d9c9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-402 Malicious code in @lxo-blocks/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74ea61fa7290aaed7a72da95ffd450ab6cc5121371e0e296eee99680c36e690e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin iQ Block Country 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An IP spoofing attack vulnerability exists in WordPress plugin iQ Block Country version 1.2.13 and prior versions, which stems from not properly...

Malicious code in amber-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3208a0e9e86eb52f116297b63ace8b8ac82e33365e0a8b566ec74be4d421633e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb407e89990bc6a460beeb330789292665ada7885bd91e2013e25ca373b54e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-26857

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

GHSA-CVJ7-5F3C-9VG9 AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

Docsify vulnerable to cross-site scripting due to mishandled encoding

docsify versions 4.12.1 and earlier are vulnerable to cross-site scripting XSS because the search component does not appropriately encode Code Blocks and mishandles the " character...

Concrete CMS Cross-site Scripting via Survey Blocks

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block. This requires at least Editor privileges...

GHSA-7388-7VQ2-M4F4 Concrete CMS Cross-site Scripting via Survey Blocks

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block. This requires at least Editor privileges...

Subrion CMS PHP Object Injection

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection with resultant file deletion via serialized data in the subpages value within a block to blocks/edit...

MediaWiki Incorrect Access Control vulnerability

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...