PT-2017-12696

Name of the Vulnerable Software and Affected Versions NexusPHP version v1.5 Description A Cross-Site Scripting XSS issue exists, allowing for potential code injection. The issue is related to the q parameter in the "searchsuggest.php" endpoint. Recommendations For NexusPHP version v1.5, consider...

CVE-2017-12798: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php...

q-lympics.de XSS vulnerability

Open Bug Bounty ID: OBB-277520 Description| Value ---|--- Affected Website:| q-lympics.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Muviko 1.0 - q SQL Injection

Muviko 1.0 - q SQL Injection Exploit Title: Muviko - Video CMS v1.0 – 'q' Parameter SQL Injection Date: 02.08.2017 Vendor Homepage: https://muvikoscript.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview Muviko is a...

PaulShop 'q' Parameter SQL Injection Vulnerability

PaulShop is a shopping cart web system. A SQL injection vulnerability exists in the PaulShop 'q' parameter. This allows attackers to exploit the vulnerability to obtain sensitive information...

Frans Visits Vegas: Frans Visits Vegas Announcement

Hey hackers and soon to be hackers! F204937 I will be doing a webinar for 1 hour at 21:00pm PDT Wednesday the 26th, the night before DEFCON and h1-702 2017. The idea is to share knowledge on how to win over security teams and gain influence as a hacker. I will cover the following topics: How I go...

q-t.nl XSS vulnerability

Vulnerable URL: http://q-t.nl/index.php/%3C!'/!%22/!/'//%22/--!%3E%3C/Title/%3C/script/%3E%3CInput%20Type=Text%20Style=position:fixed;top:0;left:0;font-size:999px%20/;%20Onmouseenter=confirm%60XSSPOSED%60%20//%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.10.2017...

SWFTools Denial of Service Vulnerability (CNVD-2017-15101)

SWFTools is a utility toolset for working with Adobe Flash files SWF files. A denial of service vulnerability exists in the 'dictlookup' function in the lib/q.c file in SWFTools version 0.9.2. An attacker can exploit this vulnerability to cause a denial of service null pointer backreference...

CVE-2017-11097

When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dictlookup function in lib/q.c...

UBUNTU-CVE-2017-11097

When SWFTools 0.9.2 processes a crafted file in swfc, it can lead to a NULL Pointer Dereference in the dictlookup function in lib/q.c...

q-i.com.pt XSS vulnerability

Vulnerable URL: http://www.q-i.com.pt/pesquisa.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check q-i.com.pt SSL connection:|...

The Bondnet Army: Questions & Answers

The following is a select list of questions and answers that we hope will shed more light on the botnet...

SOC 2 Type 1 and SOC 2 Type 2 Frequently Asked Questions

Coalfires SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you wil...

telunjuk.com XSS vulnerability

Vulnerable URL: https://www.telunjuk.com/jual?q=...

SQL Injection

github.com/gogits/gogs is vulnerable to SQL injection attacks. These attacks are possible because the q parameter is not correctly handled...

CVE-2017-5344

An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil...

PT-2017-16445

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.6.2 Description An issue was discovered in the findChildrenByFilter function, which is called by the web-accessible path /categoriesServlet. This function performs string interpolation and direct SQL query execution...

DotCMS SQL Injection Vulnerability (CNVD-2017-01933)

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build . A SQL injection vulnerability exists in categoriesServlet in DotCMS versions prior to 3.6.1. A remote attacker can explo...

DEBIAN-CVE-2016-8678

The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted file. NOTE: the vendor says "This is a Q64 issue and we do not support Q64."...

CVE-2016-8368

An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. The affected Ethernet interface module is connected to a MELSEC-Q PLC, which may allow a remote attacker to conne...