CVE-2024-3180 Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this...

CVE-2024-3180 Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this...

CVE-2024-3180

Concrete CMS CVE-2024-3180 describes a Stored XSS in blocks of type file. A rogue administrator can inject malicious code into the link-text field when creating a file block, affecting Concrete CMS versions 9.0.0–9.2.7 and 8.5.15 and earlier. Root cause is insufficient input sanitization in the f...

CVE-2024-3180 Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this...

CVE-2024-26773

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4mbtrybestfound Determine if the group block bitmap is corrupted before using acbex in ext4mbtrybestfound to avoid allocating blocks from a group with a corrupted block...

CVE-2024-26773 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4mbtrybestfound Determine if the group block bitmap is corrupted before using acbex in ext4mbtrybestfound to avoid allocating blocks from a group with a corrupted block...

CVE-2024-26704

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents movedlen In ext4moveextents, movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not...

CVE-2024-26704 ext4: fix double-free of blocks due to wrong extents moved_len

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents movedlen In ext4moveextents, movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not...

CVE-2024-26704 ext4: fix double-free of blocks due to wrong extents moved_len

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents movedlen In ext4moveextents, movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not...

CVE-2024-26685 nilfs2: fix potential bug in end_buffer_async_write

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in endbufferasyncwrite According to a syzbot report, endbufferasyncwrite, which handles the completion of block device writes, may detect abnormal condition of the buffer asyncwrite flag and cause a BUGO...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings vulnerability

AuthenticatedEditor+ Stored Cross-Site Scripting via Contact Form Message Settings vulnerability discovered by Akbar Kustirama in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.17...

PT-2024-24209 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.2.7 Concrete CMS versions 8.5.15 and earlier Description: The issue is related to Stored XSS in blocks of type file, which could be caused by a rogue administrator adding malicious code to the link-text...

PT-2024-21966 · Unknown · Genesis Blocks

Name of the Vulnerable Software and Affected Versions: Genesis Blocks versions prior to 3.1.3 Description: The issue allows attackers to conduct Stored XSS attacks by exploiting improperly escaped data input in some of the plugin's blocks, potentially enabling them to create admin accounts via...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.17 Fixed in 3.2.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0598 Patch priority Low CVSS severity Low 5.9 Developer KadenceWP PSID def3561720ef Credits Akbar...

CVE-2024-24888

Server-Side Request Forgery SSRF vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25...

CVE-2024-24888

Server-Side Request Forgery SSRF vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through = 3.2.25...

CVE-2024-24888 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through = 3.2.25...

CVE-2024-24888 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through = 3.2.25...

CVE-2024-24888

CVE-2024-24888 is a Server-Side Request Forgery (SSRF) in Gutenberg Blocks powered by Kadence Blocks. The vulnerability affects the Kadence Blocks Gutenberg Blocks plugin for WordPress, specifically versions up to 3.2.25. According to the connected Red Hat advisory, the flaw enables a server-side...

CVE-2024-1946

The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above,...