6592 matches found
CVE-2023-27923: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-27925
Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-27923
Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-27923
Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-27925
Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2022-47183
Cross-Site Request Forgery CSRF vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin = 0.2.6 versions...
CVE-2022-47183
Cross-Site Request Forgery CSRF vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin = 0.2.6 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin = 0.2.6 versions...
CVE-2022-47183
CVE-2022-47183 concerns the WordPress plugin “StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks” (versions 0.2.6) to mitigate the CSRF vulnerability; no exploit details are provided in the supplied documents.
WordPress Plugin Extra Block Design, Style, CSS for ANY Gutenberg Blocks 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2022-47183: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin = 0.2.6 versions...
kernel: ext4: fix deadlock due to mbcache entry corruption
A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute xattr blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4xattrblockset where the co...
kernel: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
A double-free vulnerability was found in the Linux kernel's MD RAID5 driver. In raid5readonechunk, when encountering badblocks during chunk-sized reads, an unnecessary bioput is called. Since the bio is also freed by the common I/O completion path, this results in a double-free condition that can...
WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" vulnerable to cross-site scripting
Overview WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" provided by Vektor,Inc. contain multiple cross-site scripting vulnerabilities CWE-79 listed below. Cross-site scripting vulnerability in Tag edit function - CVE-2023-27923 Cross-site scripting vulnerability in Post function ...
JVN#95792402: WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" vulnerable to cross-site scripting
WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" provided by Vektor,Inc. contain multiple cross-site scripting vulnerabilities CWE-79 listed below. Cross-site scripting vulnerability in Tag edit function - CVE-2023-27923 Version| Vector| Score ---|---|--- CVSS v3|...
VK Blocks < 1.54.0 - Multiple Stored XSS
The plugins do not sanitise and escape some parameters, which could lead to Stored Cross-Site Scripting issues...
Staker can avoid ETH slash by front run slashQueuedWithdrawal() with completeQueuedWithdrawal()
Lines of code Vulnerability details Impact Malicious staker can avoid the service's slash on its restaked ETH shares. Proof of Concept This issue is similar to Staker can avoid ETH slash by front run slashShares with verifyOvercommittedStake, but with a different logic. When a service/middleware...
Slashing can be frontrunned
Lines of code Vulnerability details Proof of Concept When attempting to withdraw funds, the user calls queueWithdrawal first. queueWithdrawal checks that the caller is not frozen, then marks the withdrawal as pending. function queueWithdrawal uint256 calldata strategyIndexes, IStrategy calldata...