Horizon QCMS 4.0 - Multiple Vulnerabilities

Advisory ID: HTB23191 Product: Horizon QCMS Vendor: Horizon QCMS Vulnerable Versions: 4.0 and probably prior Tested Version: 4.0 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 25, 2013 Public Disclosure: January 8,...

CVE-2013-7139

CVE-2013-7139 affects Horizon QCMS 4.0 and earlier. The vulnerability is a SQL Injection in download.php via the category parameter, caused by insufficient input validation, enabling remote attackers to execute arbitrary SQL commands on the database. Exploitation examples are documented in HTB ad...

Multiple Vulnerabilities in Horizon QCMS

Advisory ID: HTB23191 Product: Horizon QCMS Vendor: Horizon QCMS Vulnerable Versions: 4.0 and probably prior Tested Version: 4.0 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 25, 2013 Public Disclosure: January 8,...

Horizon QCMS 4.0 SQL Injection / Directory Traversal

Advisory ID: HTB23191 Product: Horizon QCMS Vendor: Horizon QCMS Vulnerable Versions: 4.0 and probably prior Tested Version: 4.0 Advisory Publication: December 18, 2013 without technical details Vendor Notification: December 18, 2013 Vendor Patch: December 25, 2013 Public Disclosure: January 8,...

CVE-2008-7139

CVE-2008-7139 covers multiple CSRF vulnerabilities in Eye-Fi’s WS-Proxy (Eye-Fi 1.1.2). The flaws allow remote attackers to hijack user authentication for requests that modify configuration via SOAPAction URIs: urn:SetOptions (autostart), urn:SetDesktopSync (file upload), urn:SetFolderConfig (fil...

CVE-2006-7139

Affected software: Kmail 1.9.1 on KDE 3.5.2. Vulnerability: when “Prefer HTML to Plain Text” is enabled, certain HTML e-mails containing specific table and frameset tags can trigger a segmentation fault, allowing remote attackers to cause a denial of service (crash). Root cause: not explicitly de...