655 matches found
WordPress Smart Google Code Inserter Plugin < 3.5 - Authentication Bypass / SQL Injection
Exploit for php platform in category web applications Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/ Software Link:...
WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection
Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/ Software Link: https://wordpress.org/plugins/smart-google-code-inserter/ Version: 3.4...
The vulnerability of the “/web/google_analytics.php” microprogramming software of Western Digital MyCloud NAS allows a intruder to execute arbitrary commands.
The vulnerability of the “/web/googleanalytics.php” microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using a specially...
HackerOne: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page
Summary: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page Description Include Impact: Since search query text can both include content of private vulnerabilities, it shouldn't be sent to Google Analytics. Furthermore, the information...
WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting Vulnerability
WordPress TR Easy Google Analytics plugin version 1.0.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently...
WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting
Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage thi...
HackerOne: Report Private Links Leaks to Google Analytics via Query String Param
Hello HackerOne Team, According to HackerOne privacy HackerOne sometimes partners with third-party services which may use various tracking technologies to provide certain services or features, including targeted online marketing. These technologies allow a partner to recognize your computer or...
Legal Robot: [Cross-domain Referer leakage] Password reset token leakage via referer
A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...
Legal Robot: Token leakage by referrer header & analytics
A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...
HackerOne: Invitation tokens leak to Google Analytics
Hi, While testing i have noticed that , the hackerone invitation token gets exposed to google-anaytics.com How? Here look at the photo- ████████ We can see that the request payload is exposing the invitation token and its not filtered like this one- ███████ And this is what google does with their...
Legal Robot: Token leakage by referrer
A security researcher discovered that password reset tokens were leaked to Intercom which provides our support chat interface and Google Analytics. While the time between a user clicking on a password reset link and actually resetting the password is typically quite low, there was still some risk...
WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications ------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...
WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications ------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...
WordPress Google Analytics Dashboard 2.1.1 Cross Site Scripting
------------------------------------------------------------------------ Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...
WordPress Google Analytics Dashboard Plugin Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Google Analytics Dashboard plugin, which allows attackers to fra...
Google Analytics Dashboard - Authenticated Cross-Site Scripting (XSS)
The google-analytics-dashboard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
HackerOne: Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
Greetings, I believe I may have found a way to bypass CSP on hackerone.com The issue lies here: img-src 'self' data: www.google-analytics.com As you can imagine, how can image tags be used maliciously here to this safe site? Well, as you know, on google-analytics.com we have the ability to host...
Shopify: apps.shopify.com - CSRF token leakage through Google Analytics
Description: When a user tries to send a support a message to an app developer in apps.shopify.com , he will be asked to login and once he is logged in , he will be redirected to apps.shopify.com/appid?authenticitytoken=currentuserauthenticitytoken. Developers can track their app page view in...
Western Digital MyCloud NAS Remote Command Injection Vulnerability
Western Digital MyCloud NAS is a personal cloud storage device. Western Digital MyCloud NAS version 2.11.142 suffers from a remote command injection vulnerability in /web/googleanalytics.php, which allows an attacker to execute arbitrary commands with root privileges via the arg parameter within...
