WordPress Hyperlink Group Block Plugin <= 1.17.5 is vulnerable to Cross Site Scripting (XSS)

Software Hyperlink Group Block Type Plugin Vulnerable versions = 1.17.5 Fixed in 1.17.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49279 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c125a0adb315 Credits Khalid Yusuf Required privileg...

PT-2024-34104

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A crash can occur in the Linux kernel when blk alloc disk fails, causing the md-disk variable to be set to an error value. The cleanup mapped device function attempts to access md-disk...

PT-2024-7931

Name of the Vulnerable Software and Affected Versions Action Mailer versions 3.0.0 through 6.1.7.8 Action Mailer versions 7.0.0 through 7.0.8.4 Action Mailer versions 7.1.0 through 7.1.4.0 Action Mailer versions 7.2.0 through 7.2.1.0 Description The issue is related to the block format helper in...

CVE-2024-6207

CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including th...

CLSA-2024-1728935304 kernel: Fix of 12 CVEs

xfs: don't walk off the end of a directory data block CVE-2024-41013 - net/sched: clsu32: fix netns refcount changes in u32change CVE-2022-29581 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - openvswitch: fix OOB access in reservesfasize CVE-2022-2639 - net: sched:...

CVE-2024-49214

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality...

SUSE CVE-2024-47164

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-38365

CVE-2024-38365 affects btcd (versions 0.10 to 0.24). The issue is a mismatch in Bitcoin Core’s FindAndDelete() versus btcd’s removeOpcodeByData() that can cause btcd to validate blocks differently, risking a chain split (accepting an invalid block) or DoS (rejecting a valid block). The root cause...

CVE-2024-9616 BlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting

The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-9616

The CVE-2024-9616 entry concerns BlockMeister – Block Pattern Builder for WordPress. A Reflected Cross-Site Scripting flaw exists in all versions up to 3.1.10 due to use of add_query_arg without proper escaping, enabling unauthenticated attackers to inject scripts into pages that run when a user ...

SUSE CVE-2024-47669

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211 "nilfs2: separate wait function from nilfssegctorwrite" was applied, the log writing function nilfssegctordoconstruct was able to issue...

btcd 安全漏洞

btcd is an alternative node-wide Bitcoin implementation written in Go golang open-sourced by Bitcoin in Go. A security vulnerability exists in btcd versions 0.10 through 0.24, which stems from a failure to properly reimplement the FindAndDelete functionality of Bitcoin Core, causing the btcd clie...

The vulnerability of the blkpg_do_ioctl() function (block/ioctl.c) in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the blkpgdoioctl function block/ioctl.c in the Linux operating system is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2024-39721 · WordPress · The Blockmeister – Block Pattern Builder

Name of the Vulnerable Software and Affected Versions: The BlockMeister – Block Pattern Builder plugin for WordPress versions up to, and including, 3.1.10 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scripting. Thi...

WordPress BlockMeister – Block Pattern Builder plugin <= 3.1.10 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin BlockMeister – Block Pattern Builder versions = 3.1.10...

SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2024:3564-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3564-1 advisory. The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes. The following security bugs were...

WordPress BlockMeister – Block Pattern Builder Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)

Software BlockMeister – Block Pattern Builder Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9616 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ebcd0d6a0a49...

DEBIAN-CVE-2024-46304

A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coaphandlerequestputblock function in src/coapblock.c...

DRUPAL-CONTRIB-2024-046

This module enables you to manage blocks from specific modules in the specific themes. The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/plugin\id/theme" route "block.admin\add". The attacker can add the block to...

CVE-2024-47669

CVE-2024-47669 relates to a Linux kernel issue in the nilfs2 file system. The vulnerability arises in the error path of the log writing function (nilfs_segctor_do_construct) after a694291a6211, enabling problematic I/O behavior across logs in segments when multiple logs are created. The root caus...