PT-2022-37150

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow WRITE crash. Technical details about the crash include the function names dynapi set helper, dwg dynapi enti...

Context - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-049

This module enables you to conditionally display blocks in particular theme regions. The module doesn't sufficiently sanitize the title of a block as displayed in the admin UI when a site administrator edits a context block reaction. This vulnerability is mitigated by the fact that an attacker mu...

GO-2022-0422 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb

The dag-pb codec can panic when decoding invalid blocks...

GSD-2022-1003244 f2fs: fix to do sanity check on total_data_blocks

f2fs: fix to do sanity check on totaldatablocks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1002951 f2fs: fix to do sanity check on total_data_blocks

f2fs: fix to do sanity check on totaldatablocks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

PT-2022-30874

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description The issue concerns a fix for a sanity check on total data blocks in f2fs. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

Yield of LiquidityReserve can be stolen

Lines of code Vulnerability details Impact Using sandwich attacks and JIT Just-in-time liquidity, the yield of LiquidityReserve could be extracted for liquidity providers. Proof of Concept The yield of LiquidityReserve is distributed when a user calls instantUnstakeReserve in Staking. Then, in...

CVE-2022-30120

XSS in /dashboard/blocks/stacks/viewdetails/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot...

CVE-2022-30120

XSS in /dashboard/blocks/stacks/viewdetails/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot...

PT-2022-20012

Name of the Vulnerable Software and Affected Versions Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 Description The issue is related to insufficient sanitation where built URLs are outputted, which can be exploited for XSS attacks when using an older browser with built-in...

Malicious Package

Overview @logistics-frontend/blocks is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Malicious Package

Overview amber-blocks is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

CVE-2017-20090

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2017-20090

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

Cross site request forgery (csrf)

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2017-20090 Global Content Blocks Plugin cross-site request forgery

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2017-20090 Global Content Blocks Plugin cross-site request forgery

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2017-20090

The CVE-2017-20090 entry concerns the WordPress plugin Global Content Blocks Plugin version 2.1.5. The vulnerability is described as enabling cross-site request forgery, with the manipulation affecting unknown code and the attack executable remotely. The connected documents corroborate a CSRF iss...

PT-2022-7963

Name of the Vulnerable Software and Affected Versions Global Content Blocks Plugin version 2.1.5 Description The issue affects unknown code and leads to cross-site request forgery. The attack can be initiated remotely. Recommendations For Global Content Blocks Plugin version 2.1.5, consider...

CVE-2017-20090: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...