Joomla Component com_qpersonel SQL Injection Vulnerability

Exploit for php platform in category web applications :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: |:: General Information |:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability |:: By = Valentin Hoebel |:: Contact = email protecte...

April 2014 Security Bulletin Webcast and Q&A

Today we published the April 2013 Security Bulletin Webcast Questions & Answers page. We answered 13 questions in total, with the majority focusing on the update for Internet Explorer MS14-018 and the Windows 8.1 Update KB2919355. Two questions that were not answered on air have been included on...

March 2014 Security Bulletin Webcast and Q&A

Today we published the March 2014 Security Bulletin Webcast Questions & Answers page. We answered eight questions in total, with the majority focusing on the updates for Windows MS14-016 and Internet Explorer MS14-012. One question that was not answered on air has been included on the Q&A page...

PT-2014-2055 · Mitsubishi · Melsec-Q Series +1

Name of the Vulnerable Software and Affected Versions: MELSEC-Q Series affected versions not specified MELSEC-L Series affected versions not specified Description: The issue is related to an integer overflow in the CPU modules of the MELSEC-Q Series and MELSEC-L Series. This can be exploited by a...

CVE-2013-7334: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter, related to CVE-2012-6290...

CVE-2012-6290: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ImageCMS before 4.2 allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to admin/adminsearch/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

Cory Support "q" SQL注入漏洞

Cory Support是一款PHP应用。 由于通过"q" GET参数传递到loadsolve.php的输入在被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 Cory Support 1.0 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://coryapp.com/page.php?id=1 // GET MySQL Injection with "q" Parameter in /loadsolve.php 1 : ?php 2 :...

Cisco TelePresence ISDN Gateway D-Channel DoS

According to its self-reported version number, the remote device is affected by a vulnerability that could allow an unauthorized user to cause a denial of service via a specially crafted Q.931 STATUS message. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72184;...

CVE-2014-0660

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

Code injection

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

CVE-2014-0660: Improper Input Validation

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

[CVE-2014-1238] Cross Site Scripting(XSS) in q-pulse application

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

Antimalware Support for Windows XP and the January 2014 Security Bulletin Webcast and Q&A

Today we’re publishing the January 2014 Security Bulletin Webcast Questions & Answers page. We answered 16 questions in total, with the majority of questions focusing on the Dynamics AX bulletin MS14-004, the update for Microsoft Word MS14-001 and the re-release of the Windows 7 and Windows Serve...

CVE-2012-6630: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 bulk parameter to media-library-categories/add.php or 2 q parameter to media-library-categories/view.php...

Q-Pulse 0.6 Cross Site Scripting

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

Predictions for 2014 and the December 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the December 2013 Security Bulletin Webcast Questions & Answers page. We answered 17 questions in total, with the majority of questions focusing on the Graphics Component bulletin MS13-096, Security Advisory 2915720 and Security Advisory 2905247. We also wanted to note a ne...

MBSA 2.3 and the November 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the November 2013 Security Bulletin Webcast Questions & Answers page. The majority of questions focused on the ActiveX Kill Bits bulletin MS13-090 and the advisories. We also answered a few general questions that were not specific to any of this month’s updates, but that ma...

2013 PCI SSC North America Meeting – Wrap-Up

Coalfire sent the entire team to the meeting in Las Vegas and everyone reported a positive and engaging experience. We hosted our annual dinner where we caught up with clients and friends - a good time was had by all. The most valuable technical information was presented during the Assessors Only...

October 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the October 2013 Security Bulletin Webcast Questions & Answers page. We fielded 11 questions during the webcast, with specific bulletin questions focusing primarily on the SharePoint MS13-084 and Kernel-Mode Drivers MS13-081 bulletins. There was one additional question that...

CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...