WordPress JS Multi Hotel Plugin <= 2.2.1 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain the installation path via a request to widget.php, functions.php, myCalendar.php, showimage.php, refreshDate.php, phpthumb/thumbplugins/gdreflection.inc.php or phpthumb/GdThumb.inc.php in includes/. Solution Update the plugin...

CVE-2013-7419

Cross-site scripting XSS vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter...

CVE-2013-7419

CVE-2013-7419 refers to a reflected XSS in the WordPress plugin Joomlaskin JS Multi Hotel (JS Multi Hotel) 2.2.1. The vulnerability is triggered in includes/refreshDate.php via the roomid parameter, allowing arbitrary web script/HTML injection in the user’s browser. The available documents identi...

Darkhotel APT Group Targeting Top Executives in Long-Term Campaign

APT groups tend to be grouped together in a large amorphous blob of sinister intentions and similar targets, but not all APT crews are created equal. Researchers have identified a group that’s been operating in Asia for at least seven years and has been using hotel networks as key infection point...

CVE-2014-7782

The Macedonia Hacienda Hotel aka appinventor.aiorolimpio999.HotelMacedonia application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7640

The Hotel Room aka com.wHotelRoom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4884

The Conrad Hotel aka com.wConradHotel application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Hotel Room aka com.wHotelRoom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Conrad Hotel aka com.wConradHotel application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Macedonia Hacienda Hotel aka appinventor.aiorolimpio999.HotelMacedonia application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7712

The Tiket.com Hotel & Flight aka com.tiket.gits application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7782

The Macedonia Hacienda Hotel aka appinventor.aiorolimpio999.HotelMacedonia application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7782

CVE-2014-7782 affects the Android application “Macedonia Hacienda Hotel” (package appinventor.ai_orolimpio999.HotelMacedonia), version 1.0. The issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive inf...

CVE-2014-7640

The Hotel Room aka com.wHotelRoom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4884

The Conrad Hotel aka com.wConradHotel application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7640

The CVE-2014-7640 entry concerns The Hotel Room (com.wHotelRoom) Android app version 0.1. The affected component is the app’s SSL/TLS certificate verification, which does not verify X.509 certificates from SSL servers. This omission allows man-in-the-middle attackers to impersonate legitimate ser...

CVE-2014-7712

The CVE-2014-7712 entry describes an Android app issue in Tiket.com Hotel & Flight (com.tiket.gits) Android app version 1.1.2, where X.509 certificates are not verified by TLS servers. This root cause allows man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted...

CVE-2014-4884

The CVE-2014-4884 entry concerns the Android application Conrad Hotel (com.wConradHotel) version 0.1, which does not verify X.509 certificates when establishing TLS connections. This improper certificate validation enables man-in-the-middle attackers to spoof SSL servers and capture sensitive inf...

CVE-2014-5831

The Hotel Story: Resort Simulation aka com.happylabs.hotelstory application 1.7.9B for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...