CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

Design/Logic Flaw

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

MGASA-2014-0379 Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q&A forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

CVE-2014-3617: Undefined Security Weakness

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-5574

The CVE-2014-5574 entry affects the Ask.fm Android app (version 1.2.4) and is caused by the application not verifying X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected documents c...

CVE-2014-5574: Undefined Security Weakness

The Ask.fm - Social Q&A Network aka com.askfm application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

August 2014 Security Bulletin Webcast and Q&A

Today, we published the August 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered ten questions on air, with the majority focusing on the update for Internet Explorer. Here is the video replay: We are aware of some issues related to the recent...

php云问答功能处存储型xss

简要描述： 需要主动触发。 详细说明： http://www.hr135.com/ask/index.php 测试地址：http://www.hr135.com/ask/index.php?c=content&id=162 超级链接写入：javascriptalert1 &NewLine是HTML5新增的实体命名编码 firebug之类工具修改链接名称增加欺骗性 成功触发JS 使用追问功能再次添加超级链接：javascriptalertdocument.cookie 成功弹出cookie 漏洞证明：...

July 2014 Security Bulletin Webcast and Q&A

Today we published the July 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered eight questions on air, with the majority focusing on the update for Internet Explorer. The transcript also includes a question we did not have time to answer on the ai...

Q-News 2.0 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15576/info Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote...

Q-Shop 3.0 - Remote XSS/SQL Injection Vulnerabilities

No description provided by source. 000000 00000 0000 0000 000 00 000000 0000000 0000 000000 00000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00000 0 0 0 0 0 0 0 0 00000 0000 0 0 0 0 00000 0 0 0 0 0 0 0 0 0 0 000 0 0 0 ...

QuadComm Q-Shop 2.5 Failure To Validate Credentials Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8153/info Zone-H has reported that the Q-Shop ASP shopping cart software contains a vulnerability that may allow remote attackers to upload arbitrary files. Once uploaded, the attacker may be able to have the script...

Duyuru Scripti Goster.ASP SQL injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22910/info Duyuru Scripti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remot...

q-news 2.0 - Remote Command Execution Exploit

No description provided by source. Author = FireShot , Jacopo Vuga. Mail = fireshotatautisticidotorg Vulnerability = Remote Command Execution Software = q-news 2.0 Download = http://ovh.dl.sourceforge.net/sourceforge/php-box/2.0nologin.zip Greets to = Osirys for his friendship and his tips, Myral...

PBLang <= 4.99.17.q Remote File Rewriting / Command Execution

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...