Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection

Type user access: admins user. $GET‘id’ is not escaped. Is accessible for only admins user. 1 - logged with admin user; 2 - send resquest get; http://www.example.com/wp-admin/admin.php?page=xtreme-locator-settings&id=0+UNION+ALL+SELECT+1%2Cslug%2Cname%2C4%2C5+FROM+wpterms+WHERE+termid%3D1...

WordPress Xtreme Locator Plugin <= 1.5 - SQL Injection

This plugin is prone to an SQL injection vulnerability, because $GET‘id’ is not escaped. Solution Update the plugin...

WordPress Xtreme Locator Plugin <= 1.5 - SQL Injection

This plugin is prone to an SQL injection vulnerability, because $GET‘id’ is not escaped. Solution Update the plugin...

Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection

Type user access: admins user. $GET‘id’ is not escaped. Is accessible for only admins user. PoC 1 - logged with admin user; 2 - send resquest get; http://www.example.com/wp-admin/admin.php?page=xtreme-locator-settings=0+UNION+ALL+SELECT+1%2Cslug%2Cname%2C4%2C5+FROM+wpterms+WHERE+termid%3D1...

tallysolutions.com XSS vulnerability

Vulnerable URL: http://www.tallysolutions.com/website/html/partner-new/locate-partner.php?searchEvent="-alertOPENBUGBOUNTY-" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 30366 VI...

Unspecified Cross-Site Scripting Vulnerability in TYPO3 Store Locator Extension

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. An unspecified cross-site scripting vulnerability exists in TYPO3 Store Locator Extension. Because the program fails to adequately filter user-supplied data, an attacker could exploit the...

Zenly Locator - Realtime GPS - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Zenly Locator - Realtime GPS published at the 'play' market has multiple vulnerabilities...

WordPress Store Locator Plus Plugin <= 4.5.10 - XSS

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...

MasterCard PayPass Locator - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application MasterCard PayPass Locator published at the 'play' market has multiple vulnerabilities...

WordPress Store Locator Plus 4.5.09 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in Store Locator Plus for WordPress ------------------------------------------------------------------------ Yorick Koster, July 2016...

Store Locator Plus for WordPress <= 4.5.10 - Authenticated Cross-Site Scripting (XSS)

The Store Locator Plus® for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Google Chrome DevTools Access Restriction Vulnerability (CNVD-2016-06146)

Google Chrome is a web browsing tool developed by Google. Google Chrome has a security vulnerability. Due to incorrect handling of the hostname of a script path, it allows remote attackers to bypass intended access restrictions via URLs. Unlike CVE-2016-5143...

truedentaldiscounts.com XSS vulnerability

Vulnerable URL: http://www.truedentaldiscounts.com/tddsearch/storelocatorresults.php?lat=39.2046386=-77.2290193=20876=%3C/script%3E%3Cimg%20src=x%20onerror=prompt/XSSPOSED/%3E0=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS...

specialized.com XSS vulnerability

Vulnerable URL: https://www.specialized.com/us/en/retailer-locator?address=...

mbusa.com XSS vulnerability

Vulnerable URL: http://www.mbusa.com/mercedes/dealers/locator?zip="onload="prompt'OPENBUGBOUNTY' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9437 VIP website status:| Yes Check...

Cisco NX-OS Software Locator/ID Separation Protocol Packet Denial of Service Vulnerability (cisco-sa-20160323-lisp)

A vulnerability in the Locator/ID Separation Protocol LISP of Cisco NX-OS Software running on the Cisco Nexus 7000 and Nexus 7700 Series Switches with an M1 Series Gigabit Ethernet Module could allow an unauthenticated, remote attacker to cause a reload of the vulnerable device. Copyright C 2016...

The vulnerability of the Cisco IOS operating system and the NX-OS network operating system allows a intruder to trigger a service failure.

The vulnerability of the Locator/ID Separation Protocol implementation in Cisco IOS operating system and NX-OS network operating system is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to trigger a service failure device reboot by using the heade...

The vulnerability of the iOS operating system and the Safari browser allows a hacker to replace the displayed URL address, circumvent existing access restrictions, and obtain confidential information.

The vulnerability of the Page Loading component implemented in WebKit of the iOS operating system and the Safari browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to replace the displayed URL address, circumvent existing access...

Family Locator - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Family Locator published at the 'play' market has multiple vulnerabilities...

Friend Locator : Phone Tracker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Friend Locator : Phone Tracker published at the 'play' market has multiple vulnerabilities...