WordPress WP-Strava plugin <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by paupu in WordPress Plugin WP-Strava versions = 2.12.1...

WordPress WP-Strava Plugin <= 2.12.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-Strava Type Plugin Vulnerable versions = 2.12.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10038 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dd6efa54c071 Credits paupu Required privilege...

CVE-2024-51603

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Mircea N. NMR Strava activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through 1.0.6...

CVE-2024-51603 WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through = 1.0.7...

CVE-2024-51603 WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through = 1.0.7...

WordPress plugin NMR Strava activities 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Florida Man Accused of Hacking Disney World Menus, Changing Font to Wingdings

Plus: Cops take down a notorious infostealer, Strava leaks world leaders’ locations, and a hacking scandal is causing chaos in Italy...

Tracking World Leaders Using Strava

Way back in 2018, people noticed that you could find secret military bases using data published by the Strava fitness app. Soldiers and other military personal were using them to track their runs, and you could look at the public data and find places where there should be no people running. Six...

WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin NMR Strava activities versions = 1.0.7...

WordPress NMR Strava activities Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software NMR Strava activities Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51603 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e4915bebbc1d Credits SOPROBRO Required privilege...

WordPress Windsor Strava Club Plugin <= 1.0.14 is vulnerable to Cross Site Scripting (XSS)

Software Windsor Strava Club Type Plugin Vulnerable versions = 1.0.14 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2effed58e825 Credits Rafie Muhammad Patchstack...

WordPress Windsor Strava Athlete Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Windsor Strava Athlete Type Plugin Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f40641265386 Credits Rafie Muhammad Patchstack...

Malicious code in @strava/clio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bddf1b07d2710c2b55871f3ed876be498c68bdd1b41fc15c176bfe104cc5ce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-616 Malicious code in @strava/clio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bddf1b07d2710c2b55871f3ed876be498c68bdd1b41fc15c176bfe104cc5ce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Windsor Strava Club plugin <= 1.0.14 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Windsor Strava Club plugin versions = 1.0.14. Solution No patched version available...

WordPress Windsor Strava Athlete plugin <= 1.3.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Windsor Strava Athlete plugin versions = 1.3.6. Solution No patched version available...

WordPress Windsor Strava Club plugin <= 1.0.14 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Windsor Strava Club plugin versions = 1.0.14. Solution No patched version available...

WordPress Windsor Strava Athlete plugin <= 1.3.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Windsor Strava Athlete plugin versions = 1.3.6. Solution No patched version available...

This Week in Security News: Magic Quadrants & Global Threats

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Gartner released its Magic Quadrant Leaders, Data Privacy Day gave us a moment to reflect, and U.K. and U.S. governments alike acted to...

Locating Secret Military Bases via Fitness Data

In November, the company Strava released an anonymous data-visualization map showing all the fitness activity by everyone using the app. Over this weekend, someone realized that it could be used to locate secret military bases: just look for repeated fitness activity in the middle of nowhere. New...