Magecart Group Switches Up Tactics with MiTM, Phishing

A fresh splinter group under the Magecart umbrella has been discovered ramping up activity starting in August-September of 2019. It’s using a unique codebase and different tactics to carry out its attacks, according to researchers. Magecart is an umbrella term encompassing several different threa...

OWOX, Inc.: The URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS.

Hi team, This is another report with 732987. Because it is completely independent Detail -- In the process of selecting the data source at https://bi.owox.com/ui/settings/connected-services/setup/, I found a reflected XSS. Specifically, when you click on Google Analytics, a page will appear for y...

Google Analytics Emerges as a Phishing Tool

Cybercriminals are leveraging key technical markers used in web analytics—particularly Google Analytics—to create more sophisticated and targeted phishing attacks, new research has found. However, this also makes them more susceptible to detection by organizations defending their sites against...

Lara Google Analytics < 2.0.5 - Authenticated Stored XSS

An authenticated stored Cross-Site Scripting XSS vulnerability within the "Google Analytics – by Lara" WordPress plugin was found to be exploited in the wild by security vendor NinTechNet...

CVE-2009-5158

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text...

Hardcoded credentials

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text...

CVE-2009-5158

The CVE-2009-5158 entry concerns the WordPress plugin google-analyticator, affected in versions prior to 5.2.1. The underlying issue is insufficient HTML sanitization of Google Analytics API text, which enables a cross-site scripting (XSS) vulnerability. Multiple connected sources (Red Hat, CNVD,...

CVE-2017-18556

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

CVE-2017-18556

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

Cross site scripting

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

CVE-2017-18556

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

CVE-2017-18556

The CVE pertains to the WordPress plugin bws-google-analytics (pre-1.7.1). The connected Nuclei template confirms multiple XSS flaws in the plugin before 1.7.1, enabling authenticated attackers to inject and execute arbitrary JavaScript in victims’ browsers (potential cookie/credentials leakage a...

CVE-2017-18556

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

WordPress bws-google-analytics plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bws-google-analytics is a plugin that uses data from the Google Analytics website analytics or website traffic tracking tool platform ...

PT-2019-8490

Name of the Vulnerable Software and Affected Versions bws-google-analytics plugin versions prior to 1.7.1 Description The issue is related to multiple XSS problems. Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue...

CVE-2017-18556: Improper Neutralization of Input During Web Page Generation

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues...

No man’s land: How a Magecart group is running a web skimming operation from a war zone

Our Threat Intelligence team has been monitoring the activities of a number of threat actors involved in the theft of credit card data. Often referred to under the Magecart moniker, these groups use simple pieces of JavaScript code skimmers typically injected into compromised e-commerce websites ...

Ads For WP <= 1.8 - Cross-Site Request Forgery (CSRF)

CSRF allowing attacker to disconnect the linked Google Analytics from the plugin's settings...

GA Backend Tracking <= 1.2 - XSS

The Google Analytics Backend Tracking woocommerce support – WordPress Plugin WordPress plugin was affected by a XSS security vulnerability...

DoorGets Cross-Site Request Forgery Vulnerability

DoorGets is a free and open source content management system. A cross-site request forgery vulnerability exists in /doorgets/app/requests/user/configurationRequest.php in doorGets 7.0. A remote attacker can exploit this vulnerability to modify "Google Analytics code"...