Stored XSS in TimelineJS3

Impact TimelineJS renders some user data as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users...

CVE-2020-15092 Stored XSS in TimelineJS3

In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...

Knight Lab Timeline < 3.7.0.0 - Outdated TimelineJS library could Lead to Stored XSS

The plugin used the TimelineJS library 3.7.0 which is affected by a stored Cross-Site Scripting issues if an attacker has write privileges on the source data used for the timeline which is stored on Google Sheets or in a JSON configuration file...

Shopify: Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections

The following report intends to disclose a bypass for 416983. It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description Signed URLs generated by Shopify Flow https://apps.shopify.com/flow use a...

Shopify: H1514 Removed Staff members who had "Apps" permission can still modify flow app connections

Summary: It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description: Flow app https://apps.shopify.com/flow allows users to connect their Google Sheets, Trello and Asana accounts to their flow...

Google Sheets - BSD license, Exported ContentProvider, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Google Sheets published at the 'play' market has multiple vulnerabilities...

Carbanak Using Google Services for Command and Control

Carbanak certainly has not sat idly by after years of advanced criminal campaigns targeting primarily financial institutions. The outfit, alleged to have stolen from more than 100 banks worldwide, has popped up again with a new means of managing command and control over its malware and implants...

Uber: XSS in ubermovement.com via editable Google Sheets

A publicly-editable Google Sheet rendered on various ubermovement.com subdomains allowed anyone to inject HTML content into the page. It was possible for an attacker to inject malicious JavaScript code into the page by editing cells within the sheet, which would then be loaded by anyone who viewe...