Legal Robot: [Cross-domain Referer leakage] Password reset token leakage via referer

A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...

Legal Robot: Token leakage by referrer header & analytics

A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...

HackerOne: Invitation tokens leak to Google Analytics

Hi, While testing i have noticed that , the hackerone invitation token gets exposed to google-anaytics.com How? Here look at the photo- ████████ We can see that the request payload is exposing the invitation token and its not filtered like this one- ███████ And this is what google does with their...

Legal Robot: Token leakage by referrer

A security researcher discovered that password reset tokens were leaked to Intercom which provides our support chat interface and Google Analytics. While the time between a user clicking on a password reset link and actually resetting the password is typically quite low, there was still some risk...

WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

WordPress Google Analytics Dashboard Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Google Analytics Dashboard plugin, which allows attackers to fra...

Google Analytics Dashboard - Authenticated Cross-Site Scripting (XSS)

The google-analytics-dashboard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

HackerOne: Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com

Greetings, I believe I may have found a way to bypass CSP on hackerone.com The issue lies here: img-src 'self' data: www.google-analytics.com As you can imagine, how can image tags be used maliciously here to this safe site? Well, as you know, on google-analytics.com we have the ability to host...

Shopify: apps.shopify.com - CSRF token leakage through Google Analytics

Description: When a user tries to send a support a message to an app developer in apps.shopify.com , he will be asked to login and once he is logged in , he will be redirected to apps.shopify.com/appid?authenticitytoken=currentuserauthenticitytoken. Developers can track their app page view in...

Western Digital MyCloud NAS Remote Command Injection Vulnerability

Western Digital MyCloud NAS is a personal cloud storage device. Western Digital MyCloud NAS version 2.11.142 suffers from a remote command injection vulnerability in /web/googleanalytics.php, which allows an attacker to execute arbitrary commands with root privileges via the arg parameter within...

CVE-2016-10108

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...

WordPress Plugin Google Analytics Counter Tracker PHP Object Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WordPress plugin Google Analytics Counter Tracker has a PHP object injection vulnerability, the vulnerability...

WordPress Google Analytics Counter Tracker 3.1.5 PHP Object Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability -----------------------------------------------------------------------...

Updated python-tornado package fixes security vulnerability

A difference in cookie parsing between Tornado and web browsers especially when combined with Google Analytics could allow an attacker to set arbitrary cookies and bypass XSRF protection. The cookie parser has been rewritten to fix this attack...

WordPress Google Analytics Counter Tracker 3.1.5 PHP Object Injection

------------------------------------------------------------------------ Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability ------------------------------------------------------------------------ Remco Vermeulen, July 2016...

WordPress Google Analytics Counter Tracker Plugin <= 3.4.0 - PHP Object Injection

This plugin is prone to a PHP object injection vulnerability. It allows attackers to execute arbitrary PHP code. Solution Update the plugin...

WordPress Google Analytics Counter Tracker Plugin <= 3.4.0 - PHP Object Injection

This plugin is prone to a PHP object injection vulnerability. It allows attackers to execute arbitrary PHP code. Solution Update the plugin...

Fedora Update for drupal7-google_analytics FEDORA-2016-9c04d7e5c5

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...