[SECURITY] Fedora 26 Update: q-7.11-29.fc26

Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced application...

ImageMagick Denial of Service Vulnerability (CNVD-2017-26585)

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A denial of service vulnerability exists in the ReadMPCImage of the coders/mpc.c file in ImageMagick version 7.0.6-8 Q16, which stems from the program failing to...

CVE-2017-12798

Cross-Site Scripting XSS exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php...

PT-2017-12696

Name of the Vulnerable Software and Affected Versions NexusPHP version v1.5 Description A Cross-Site Scripting XSS issue exists, allowing for potential code injection. The issue is related to the q parameter in the "searchsuggest.php" endpoint. Recommendations For NexusPHP version v1.5, consider...

CVE-2017-12798: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php...

q-lympics.de XSS vulnerability

Open Bug Bounty ID: OBB-277520 Description| Value ---|--- Affected Website:| q-lympics.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Muviko 1.0 - q SQL Injection

Muviko 1.0 - q SQL Injection Exploit Title: Muviko - Video CMS v1.0 – 'q' Parameter SQL Injection Date: 02.08.2017 Vendor Homepage: https://muvikoscript.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview Muviko is a...

PaulShop 'q' Parameter SQL Injection Vulnerability

PaulShop is a shopping cart web system. A SQL injection vulnerability exists in the PaulShop 'q' parameter. This allows attackers to exploit the vulnerability to obtain sensitive information...

Frans Visits Vegas: Frans Visits Vegas Announcement

Hey hackers and soon to be hackers! F204937 I will be doing a webinar for 1 hour at 21:00pm PDT Wednesday the 26th, the night before DEFCON and h1-702 2017. The idea is to share knowledge on how to win over security teams and gain influence as a hacker. I will cover the following topics: How I go...

q-t.nl XSS vulnerability

Vulnerable URL: http://q-t.nl/index.php/%3C!'/!%22/!/'//%22/--!%3E%3C/Title/%3C/script/%3E%3CInput%20Type=Text%20Style=position:fixed;top:0;left:0;font-size:999px%20/;%20Onmouseenter=confirm%60XSSPOSED%60%20//%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.10.2017...

SWFTools Denial of Service Vulnerability (CNVD-2017-15101)

SWFTools is a utility toolset for working with Adobe Flash files SWF files. A denial of service vulnerability exists in the 'dictlookup' function in the lib/q.c file in SWFTools version 0.9.2. An attacker can exploit this vulnerability to cause a denial of service null pointer backreference...

CVE-2017-11097

When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dictlookup function in lib/q.c...

UBUNTU-CVE-2017-11097

When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dictlookup function in lib/q.c...

q-i.com.pt XSS vulnerability

Vulnerable URL: http://www.q-i.com.pt/pesquisa.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check q-i.com.pt SSL connection:|...

The Bondnet Army: Questions & Answers

The following is a select list of questions and answers that we hope will shed more light on the botnet...

SOC 2 Type 1 and SOC 2 Type 2 Frequently Asked Questions

Coalfires SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you wil...

telunjuk.com XSS vulnerability

Vulnerable URL: https://www.telunjuk.com/jual?q=...

SQL Injection

github.com/gogits/gogs is vulnerable to SQL injection attacks. These attacks are possible because the q parameter is not correctly handled...

CVE-2017-5344

An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil...

PT-2017-16445

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.6.2 Description An issue was discovered in the findChildrenByFilter function, which is called by the web-accessible path /categoriesServlet. This function performs string interpolation and direct SQL query execution...