Google Settles $5 Billion Privacy Lawsuit Over Tracking Users in 'Incognito Mode'

Google has agreed to settle a lawsuit filed in June 2020 that alleged that the company misled users by tracking their surfing activity who thought that their internet use remained private when using the "incognito" or "private" mode on web browsers. The class-action lawsuit sought at least $5...

WordPress CAOS | Host Google Analytics Locally Plugin <= 4.7.14 is vulnerable to Broken Access Control

Software CAOS | Host Google Analytics Locally Type Plugin Vulnerable versions = 4.7.14 Fixed in 4.7.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6637 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 62929a294e3e Credits...

CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

Cross site scripting

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276

CVE-2023-49276 affects Uptime Kuma (open-source self-hosted monitoring tool). The vulnerability arises from an attribute injection in the Google Analytics element due to unsanitized template usage, enabling Cross-Site Scripting (XSS) when a custom Google Analytics ID is set via the status interfa...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

Cross Site Scripting (XSS)

uptime-kuma is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper validation of google analytics tagID. An attacker can inject malicious javascript and perform session hijacking...

Attribute Injection leading to XSS(Cross-Site-Scripting)

Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...

GHSA-V4V2-8H88-65QJ Attribute Injection leading to XSS(Cross-Site-Scripting)

Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...

PT-2023-31143 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.7 Description: The Google Analytics element in Uptime Kuma is vulnerable to Attribute Injection, leading to Cross-Site-Scripting XSS attacks. This occurs because the custom status interface can set an...

Analytify Dashboard < 5.2.0 - Cross-Site Request Forgery

Description The Analytify – Google Analytics Dashboard For WordPress GA4 analytics made easy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the sendanalyticsemail function. This...

CVE-2023-46094 WordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin = 6.5.3 versions...

CVE-2023-46094

CVE-2023-46094 affects the Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin (WordPress) up to version 6.5.3. In the advisory, the vulnerability is described as unauthenticated Reflected Cross-Site Scripting (XSS) with impact on co...

WordPress Plugin Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Track Google Analytics 4,...

WordPress MonsterInsights - Google Analytics Dashboard Plugin < 8.9.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:monsterinsights:monsterinsights"; ifdescription...

WordPress MonsterInsights - Google Analytics Dashboard Plugin < 8.14.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:monsterinsights:monsterinsights"; ifdescription...

CVE-2023-23651

Auth. subscriber+ SQL Injection SQLi vulnerability in MainWP Google Analytics Extension plugin = 4.0.4 versions...

CVE-2023-23651

Auth. subscriber+ SQL Injection SQLi vulnerability in MainWP Google Analytics Extension plugin = 4.0.4 versions...

CVE-2023-23651 WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability

Auth. subscriber+ SQL Injection SQLi vulnerability in MainWP Google Analytics Extension plugin = 4.0.4 versions...