technology software

e-commerce shopping

documentation technical

finance banking

English

_snow_id.6430

__cf_bm

_snow_ses.6430

Domain 'chipotlemobile.weebly.com' uses the commercial generic top-level domain (.com) with subdomain 'chipotlemobile'. The core label 'weebly' covers 6 characters holding two vowels versus 4 consonants. Tokenizing the label suggests two words: wee, bly. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

html/f1/42/f142ed65-3813-437b-a6e4-4641c433dc55.html.gz

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

sandbox; default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none';

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0

47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

bbc96de10a2edd1c6c1170882832dad8409eb55df2e5ae9f9530d110cc03d7c6

e06baca13f25df9c7d684fc1b1fdfbbbb95070a1d5a9cd648632da7bccc90b96

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

d2cc54b76277ed03f2100a982d1c04f97f8c6974edaf6fc5a8d051c785d69b9b

Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.9.0 or later.

jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

4eacfa50322f3930413f9c7a20d92405f70f1cd07006cc26acc0981979accda6

5d77176826d5bc98a77fde8f51044d3154d2e74bba0324d7122c005ba6f3a2dc

fcf1cbf5cfad6d605868f42d38a0a937f5e6eaa91b05dcfbbbc95e4c3e23e528

1fa5bb05c082abae5b2906db654d341dbecd43ae7dd081cebaaf4344cd4066c9

416001b361f6d6609e811d2688e1d508e665133036b641a35ec9ea070ed53576

966050198c27c6cc3c6cad0d9726f3e66d72c4288197a29d1ebe0f94372613c0

a50f8a487c23d76460681440220a85a28cdb09912ef451d59aa2b4f47c32aea0

60f5f57c7458d9adfc9ee25e40ae9bb2c7de1b4f08fdfe4b9f57731a6c98f278

3e72636c6cf854c8657ccbf9e03f7af05bd4836066c329417a4f8251bb5d18c1

45988af53e17c3bc8103bbe22bd47dd6d2d03d4a90c4116dc0621ab24ff87258

bfce257e15e925e3be6e00aee1711a9e47d623dff36d8b14390572a77e46829a

http://bluerocket.us/clients/chipotle-mobile-restaurant-app/

In March of this year, Chipotle teamed up with  Blue Rocket , a leading custom mobile app development firm, to develop the Chipotle iPhone Ordering app, the first major release of the Chipotle app...

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/5163746.jpg

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/8597469_orig.jpg

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/2897112.jpg?791

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/7562224.jpg?661

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/2985151.jpg?706

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/1608437.jpg?774

http://chipotlemobile.weebly.com/uploads/1/0/0/0/10007524/5650629_orig.png

http://chipotlemobile.weebly.com/mobile-app.html

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

default-src 'none'; script-src 'nonce-XBGVPfpqiGrqEKI2thgOHV' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

MarkMonitor Inc.

WEEBLY.COM

Abuse

Google LLC

GOOGLE


							Weebly = Weebly || {};
							Weebly.Commerce = Weebly.Commerce || {};
							Weebly.Commerce.hasCart = false;
						


	if (document.readystate === 'complete') {
		Weebly.footer.setupContainer('cdn11.editmysite.com', '1781722101');
	} else {
		document.addEventListener('DOMContentLoaded', function() {
			Weebly.footer.setupContainer('cdn11.editmysite.com', '1781722101');
		});
	}


//


	// NOTE: keep the getElementsByTagName(o)**[1]** if you replace this code. Otherwise cookie banner scripts won't be first on the page
	;(function(p,l,o,w,i,n,g){if(!p[i]){p.GlobalSnowplowNamespace=p.GlobalSnowplowNamespace||[];
			p.GlobalSnowplowNamespace.push(i);p[i]=function(){(p[i].q=p[i].q||[]).push(arguments)
			};p[i].q=p[i].q||[];n=l.createElement(o);g=l.getElementsByTagName(o)[1];n.async=1;
			n.src=w;g.parentNode.insertBefore(n,g)}}(window,document,'script','//cdn2.editmysite.com/js/wsnbn/snowday262.js','snowday'));

	var r = [99, 104, 101, 99, 107, 111, 117, 116, 46, 40, 119, 101, 101, 98, 108, 121, 124, 101, 100, 105, 116, 109, 121, 115, 105, 116, 101, 41, 46, 99, 111, 109];
	var snPlObR = function(arr) {
		var s = '';
		for (var i = 0 ; i < arr.length ; i++){
			s = s + String.fromCharCode(arr[i]);
		}
		return s;
	};
	var s = snPlObR(r);

	var regEx = new RegExp(s);

	_W.Analytics = _W.Analytics || {'trackers': {}};
	_W.Analytics.trackers.wSP = 'snowday';
	_W.Analytics.user_id = '10007524';
	_W.Analytics.site_id = '590451682266392132';


	(function(app_id, ec_hostname, discover_root_domain) {
		var track = window[_W.Analytics.trackers.wSP];
		if (!track) return;
		track('newTracker', app_id, ec_hostname, {
			appId: app_id,
			post: true,
			platform: 'web',
			discoverRootDomain: discover_root_domain,
			cookieName: '_snow_',
			contexts: {
				webPage: true,
				performanceTiming: true,
				gaCookies: true
			},
			crossDomainLinker: function (linkElement) {
				return regEx.test(linkElement.href);
			},
			respectDoNotTrack: true
		});
		track('trackPageView', _W.Analytics.user_id+':'+_W.Analytics.site_id, _W.Analytics.spContexts);
		track('crossDomainLinker', function (linkElement) {
			return regEx.test(linkElement.href);
		});
	})(
		'_wn',
		'ec.editmysite.com',
		false
	);



	window._W.isEUUser = true;
	window._W.showCookieToAll = "";


Requests	IP Address	Location	AS Autonomous System
36	74.115.51.9	United States	AS27647Weebly, Inc.
36	1	-	-

Security Scan Report: chipotlemobile.weebly.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Website Access Blocked

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History