CVE-2017-20175

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the...

Cross site scripting

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the...

CVE-2017-20175 DaSchTour matomo-mediawiki-extension Username Piwik.hooks.php cross site scripting

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the...

CVE-2017-20175

The CVE-2017-20175 entry concerns DaSchTour matomo-mediawiki-extension (up to version 2.4.2) running on MediaWiki, with a cross-site scripting flaw in an unknown part of Piwik.hooks.php within the Username Handler. The issue can be triggered remotely, though attack complexity is described as high...

MediaWiki 跨站脚本漏洞

MediaWiki is a free and free-to-use web-based wiki engine from the US-based MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems.MediaWiki matomo-mediawiki-extension suffers from a cross-site scripting vulnerability that stems from a...

MainWP Matomo Extension < 4.0.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software MainWP Matomo Extension Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23659 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7f66647065f9 Credits Dave Jong...

CVE-2022-33156

The matomointegration aka Matomo Integration extension before 1.3.2 for TYPO3 allows XSS...

CVE-2022-33156

The matomointegration aka Matomo Integration extension before 1.3.2 for TYPO3 allows XSS...

Cross site scripting

The matomointegration aka Matomo Integration extension before 1.3.2 for TYPO3 allows XSS...

CVE-2022-33156

The matomointegration aka Matomo Integration extension before 1.3.2 for TYPO3 allows XSS...

CVE-2022-33156

The CVE-2022-33156 entry concerns the matomo_integration (TYPO3) extension, with vulnerable versions prior to 1.3.2. Concrete details from connected sources indicate: (1) vulnerability is Cross-Site Scripting (XSS) due to improper encoding of user input in HTML output, (2) exploitation generally ...

Malicious code in matomo-analytics-cloudflare-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379cfcf198b8b35c36cafb16790478cac75d84f6f4c52217add6893135f41d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4496 Malicious code in matomo-analytics-cloudflare-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379cfcf198b8b35c36cafb16790478cac75d84f6f4c52217add6893135f41d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-Site Scripting (XSS)

brotkrueml/typo3-matomo-integration is vulnerable to cross-site scripting. The vulnerability exists in convertStringValue function in MatomoMethodCall.php because the content from PSR-14 events are not properly escaped which allows an attackers to inject and execute arbitrary javascript...

brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

GHSA-GVXV-P9RV-GMCG brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

PT-2022-21716 · Typo3 · Wp-Matomo Integration

Name of the Vulnerable Software and Affected Versions: matomo integration extension versions prior to 1.3.2 Description: The issue allows for XSS due to the extension's failure to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit this issue...

Piwik (now Matomo) Reveals Sensitive Information by Accepting Input from `POST` Requests

Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters...

WP-Matomo Integration (WP-Piwik) < 1.0.27 - Plugin Settings Reset via CSRF

The plugin does not have CSRF when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack https://example.com/wp-admin/options-general.php?page=wp-piwik%2Fclasses%2FWPPiwik.php&clear=2...