585 matches found
Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode
Google faces a $5 billion class-action lawsuit over claims that it has been collecting people’s browsing information without their knowledge even when using the incognito browsing mode that’s meant to keep their online activities private. The lawsuit, filed in the federal court in San Jose,...
Wacom Tablet Data Exfiltration Raises Security Concerns
The Wacom digital drawing tablet appears to be silently exfiltrating user data, according to an investigation by software engineer Robert Heaton – and the company responded on Friday, downplaying the report. However, security researchers say the tablets still pose a risk and a privacy problem...
Magecart Group Switches Up Tactics with MiTM, Phishing
A fresh splinter group under the Magecart umbrella has been discovered ramping up activity starting in August-September of 2019. It’s using a unique codebase and different tactics to carry out its attacks, according to researchers. Magecart is an umbrella term encompassing several different threa...
OWOX, Inc.: The URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS.
Hi team, This is another report with 732987. Because it is completely independent Detail -- In the process of selecting the data source at https://bi.owox.com/ui/settings/connected-services/setup/, I found a reflected XSS. Specifically, when you click on Google Analytics, a page will appear for y...
Google Analytics Emerges as a Phishing Tool
Cybercriminals are leveraging key technical markers used in web analytics—particularly Google Analytics—to create more sophisticated and targeted phishing attacks, new research has found. However, this also makes them more susceptible to detection by organizations defending their sites against...
Lara Google Analytics < 2.0.5 - Authenticated Stored XSS
An authenticated stored Cross-Site Scripting XSS vulnerability within the "Google Analytics – by Lara" WordPress plugin was found to be exploited in the wild by security vendor NinTechNet...
CVE-2009-5158
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text...
Hardcoded credentials
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text...
CVE-2009-5158
The CVE-2009-5158 entry concerns the WordPress plugin google-analyticator, affected in versions prior to 5.2.1. The underlying issue is insufficient HTML sanitization of Google Analytics API text, which enables a cross-site scripting (XSS) vulnerability. Multiple connected sources (Red Hat, CNVD,...
CVE-2017-18556
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...
CVE-2017-18556
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...
Cross site scripting
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...
CVE-2017-18556
The CVE pertains to the WordPress plugin bws-google-analytics (pre-1.7.1). The connected Nuclei template confirms multiple XSS flaws in the plugin before 1.7.1, enabling authenticated attackers to inject and execute arbitrary JavaScript in victims’ browsers (potential cookie/credentials leakage a...
CVE-2017-18556
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...
WordPress bws-google-analytics plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bws-google-analytics is a plugin that uses data from the Google Analytics website analytics or website traffic tracking tool platform ...
No man’s land: How a Magecart group is running a web skimming operation from a war zone
Our Threat Intelligence team has been monitoring the activities of a number of threat actors involved in the theft of credit card data. Often referred to under the Magecart moniker, these groups use simple pieces of JavaScript code skimmers typically injected into compromised e-commerce websites ...
Ads For WP <= 1.8 - Cross-Site Request Forgery (CSRF)
CSRF allowing attacker to disconnect the linked Google Analytics from the plugin's settings...
GA Backend Tracking <= 1.2 - XSS
The Google Analytics Backend Tracking woocommerce support – WordPress Plugin WordPress plugin was affected by a XSS security vulnerability...
DoorGets Cross-Site Request Forgery Vulnerability
DoorGets is a free and open source content management system. A cross-site request forgery vulnerability exists in /doorgets/app/requests/user/configurationRequest.php in doorGets 7.0. A remote attacker can exploit this vulnerability to modify "Google Analytics code"...