MAL-2022-5189 Malicious code in page-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b34f0384ae5c4174f21aa87a140a1c67dbbfa56d22ec198c231d07c6a28edb66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1622 Malicious code in blocks-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56aa6e61ddb94ea4a56ee9d895d73d3be13dd9ebf1d7b5ae3343d24a963d9c9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blocks-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56aa6e61ddb94ea4a56ee9d895d73d3be13dd9ebf1d7b5ae3343d24a963d9c9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-402 Malicious code in @lxo-blocks/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74ea61fa7290aaed7a72da95ffd450ab6cc5121371e0e296eee99680c36e690e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin iQ Block Country 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An IP spoofing attack vulnerability exists in WordPress plugin iQ Block Country version 1.2.13 and prior versions, which stems from not properly...

Malicious code in amber-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3208a0e9e86eb52f116297b63ace8b8ac82e33365e0a8b566ec74be4d421633e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb407e89990bc6a460beeb330789292665ada7885bd91e2013e25ca373b54e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-26857

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

GHSA-CVJ7-5F3C-9VG9 AttesterSlashing number overflow

Impact Possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Since we represent uint64 values as native javascript numbers, there is an issue when those variables with large greater than 2^53 uint64 values are included on chain. In those...

Docsify vulnerable to cross-site scripting due to mishandled encoding

docsify versions 4.12.1 and earlier are vulnerable to cross-site scripting XSS because the search component does not appropriately encode Code Blocks and mishandles the " character...

GHSA-7388-7VQ2-M4F4 Concrete CMS Cross-site Scripting via Survey Blocks

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block. This requires at least Editor privileges...

Concrete CMS Cross-site Scripting via Survey Blocks

Concrete CMS formerly concrete5 before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting XSS attacks via a crafted survey block. This requires at least Editor privileges...

Subrion CMS PHP Object Injection

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection with resultant file deletion via serialized data in the subpages value within a block to blocks/edit...

MediaWiki Incorrect Access Control vulnerability

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Code injection

Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...

Client BlockTokens not checked in Apache Hadoop

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and...

CVE-2022-28937

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via an invalid proposal with an invalid header, will cause normal nodes to stop producing new blocks and processing new clients' requests...

Croogo vulnerable to XSS in title field

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8...

GHSA-V6Q8-8WGX-8HM7 Croogo vulnerable to XSS in title field

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8...