CVE-2019-11617

doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification...

Cross site request forgery (csrf)

doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification...

CVE-2019-11617

doorGets 7.0 is affected by a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php that allows a remote attacker to modify the Google Analytics code. Affected component is the configurationRequest endpoint; root cause is CSRF in user configuration handling. Documents consist...

CVE-2019-11617

doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification...

Card-Skimming Scripts Hide Behind Google Analytics, Angular

A host of credit card-stealing scripts have popped up on the web, injected into websites and purporting to be legitimate Google Analytics or Angular utilities in order to avoid webmaster notice. According to research from Sucuri, the malicious code is obfuscated and injected into legitimate JS...

Cross-Site Request Forgery (CSRF) Protection Bypass

Django is vulnerable to cross-site request forgery CSRF. An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to the bypass of CSRF protection...

WordPress Google Analytics by Monster Insights plugin <= 7.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Google Analytics by Monster Insights plugin versions = 7.1.0. Solution Update the WordPress Google Analytics by Monster Insights plugin to the latest available version at least 7.2.0...

VisionDirect hacked: Hackers infect domains with malicious Google Analytics code

By Waqas Hackers using Google Adwords & Google Sites to spread malwareVisionDirect, one of Europe's largest online optical retailer that deals with contact lenses and eye care related products has announced that a number of its domains have suffered a data breach in which hackers stole customers'...

Google's G Suite, Search and Analytics Taken Down in Hijacking

Google said key business services were knocked offline Monday when web traffic to a portion of its cloud platform was hijacked and routed through Chinese, Nigerian and Russian ISPs. The incident lasted for 74 minutes in what is called a Border Gateway Protocol BGP hijacking. BGP is a protocol tha...

PullString: Eternal "change password" link.

Hi. Link for password change does not exprire after first use and may be reused many times, resulting password change every time. The issue is such links leak to google-analytics. I'd suggest expire link after first use. Also you store the link in Log output. This means easy leveraging XSS to...

Liberapay: Current CSP Policy chained with HTML Injection can lead to Data Exfiltration

Hi Team, Summary While reviewing the CSP headers for en.liberapay.com i noticed that img-src has a source set to which means any source on the internet. The following is found in the current CSP Header config. img-src blob: data: Description: If the site is vulnerable to HTML Injection its possib...

Monstra CMS before 3.0.4 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monstra is ...

WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection

WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/...

WordPress Smart Google Code Inserter Plugin < 3.5 - Authentication Bypass / SQL Injection

Exploit for php platform in category web applications Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/ Software Link:...

WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection

Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/ Software Link: https://wordpress.org/plugins/smart-google-code-inserter/ Version: 3.4...

The vulnerability of the “/web/google_analytics.php” microprogramming software of Western Digital MyCloud NAS allows a intruder to execute arbitrary commands.

The vulnerability of the “/web/googleanalytics.php” microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using a specially...

HackerOne: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page

Summary: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page Description Include Impact: Since search query text can both include content of private vulnerabilities, it shouldn't be sent to Google Analytics. Furthermore, the information...

WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting Vulnerability

WordPress TR Easy Google Analytics plugin version 1.0.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently...

WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting

Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage thi...

HackerOne: Report Private Links Leaks to Google Analytics via Query String Param

Hello HackerOne Team, According to HackerOne privacy HackerOne sometimes partners with third-party services which may use various tracking technologies to provide certain services or features, including targeted online marketing. These technologies allow a partner to recognize your computer or...