Cross site scripting

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

UBUNTU-CVE-2020-25628

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

CVE-2020-25628

CVE-2020-25628 affects Moodle tag manager filter: a lack of sufficient sanitizing creates a reflected XSS risk. Affected versions: 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and older unsupported versions. Fixed in: 3.9.2, 3.8.5, 3.7.8 and 3.5.14. Remediation: upgrade to one of the f...

CVE-2020-25628

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

coderedcms (>=0.18.0 <=0.18.2), coop (>=2.8.0 <=2.8.2) +12 more potentially affected by CVE-2020-15118 via wagtail (>=2.8.0 <=2.8.2)

wagtail PYPI version =2.8.0, =0.18.0, =2.8.0, =0.0.5, =4.1.0, =0.5.0, =1.0.0, =0.22.0, =0.9.8, =3.8.0, =3.9.0 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

Eight Cryptojacking Apps Booted From Microsoft Store

Microsoft booted eight malicious apps from its official desktop and mobile app store after researchers found the programs surreptitiously mined for Monero cryptocurrency. Researchers who discovered the apps said that an unspecified, but significant number, of users may have downloaded the rogue...

WordPress Metronet Tag Manager Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Metronet Tag Manager is used in one of the tracking code manager plugin. A cross-site request forgery vulnerabilit...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

Cross site request forgery (csrf)

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

CVE-2018-1000506

The issue affects the WordPress plugin Metronet Tag Manager, version 1.2.7. It contains a Cross-Site Request Forgery (CSRF) vulnerability on the Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can allow a logged-in attacker to perform administrator actions. The vulnerab...

CVE-2018-1000506

Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery CSRF vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must...

WordPress Metronet Tag Manager plugin <=1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Tom Adams dxw in WordPress Metronet Tag Manager plugin versions =1.2.7. Solution Update the WordPress Metronet Tag Manager plugin to the latest available version at least 1.2.9...

WordPress Metronet Tag Manager 1.2.7 Plugin - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Press submit on a page containing the following HTML snippet: alert1" !-- In a real attack, the form can be made to autosubmit so the victim only has to follow a link. Mitigations ================ Upgrade to version 1.2.9 or later...

WordPress Plugin Metronet Tag Manager 1.2.7 - Cross-Site Request Forgery

Press submit on a page containing the following HTML snippet: alert1" !-- In a real attack, the form can be made to autosubmit so the victim only has to follow a link. Mitigations ================ Upgrade to version 1.2.9 or later. Disclosure policy ================ dxw believes in responsible...

WordPress Plugin Metronet Tag Manager 1.2.7 - Cross-Site Request Forgery

WordPress Plugin Metronet Tag Manager 1.2.7 - Cross-Site Request Forgery Press submit on a page containing the following HTML snippet: alert1" !-- In a real attack, the form can be made to autosubmit so the victim only has to follow a link. Mitigations ================ Upgrade to version 1.2.9 or...

Metronet Tag Manager <= 1.2.7 - Cross-Site Request Forgery (CSRF)

The Metronet Tag Manager WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

Metronet Tag Manager 1.2.7 Cross Site Request Forgery

Details ================ Software: Metronet Tag Manager Version: 1.2.7 Homepage: https://wordpress.org/plugins/metronet-tag-manager/ Advisory report: https://advisories.dxw.com/advisories/csrf-metronet-tag-manager/ CVE: Awaiting assignment CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N Description...