Malicious code in tealium-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3083 Malicious code in tealium-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=-...

Uber: Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains

When creating new tags on Tealium, the application did not check that the user creating the tag had authorized as the same account they were creating a tag for. It was possible for an attacker to inject arbitrary content into a web page using the utag.js tag. Depending on how the victim implement...

Uber: Stored XSS on any page in most Uber domains

Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password a...