MGASA-2014-0379 Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q&A forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

CVE-2014-3617: Undefined Security Weakness

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-5574

The CVE-2014-5574 entry affects the Ask.fm Android app (version 1.2.4) and is caused by the application not verifying X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected documents c...

CVE-2014-5574: Undefined Security Weakness

The Ask.fm - Social Q&A Network aka com.askfm application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6559

Name of the Vulnerable Software and Affected Versions Ask.fm - Social Q&A Network aka com.askfm version 1.2.4 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

August 2014 Security Bulletin Webcast and Q&A

Today, we published the August 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered ten questions on air, with the majority focusing on the update for Internet Explorer. Here is the video replay: We are aware of some issues related to the recent...

php云问答功能处存储型xss

简要描述： 需要主动触发。 详细说明： http://www.hr135.com/ask/index.php 测试地址：http://www.hr135.com/ask/index.php?c=content&id=162 超级链接写入：javascriptalert1 &NewLine是HTML5新增的实体命名编码 firebug之类工具修改链接名称增加欺骗性 成功触发JS 使用追问功能再次添加超级链接：javascriptalertdocument.cookie 成功弹出cookie 漏洞证明：...

July 2014 Security Bulletin Webcast and Q&A

Today we published the July 2014 Security Bulletin webcast questions and answers page along with the webcast replay. We answered eight questions on air, with the majority focusing on the update for Internet Explorer. The transcript also includes a question we did not have time to answer on the ai...

Q-News 2.0 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15576/info Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote...

Duyuru Scripti Goster.ASP SQL injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22910/info Duyuru Scripti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remot...

QuadComm Q-Shop 2.5 Failure To Validate Credentials Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8153/info Zone-H has reported that the Q-Shop ASP shopping cart software contains a vulnerability that may allow remote attackers to upload arbitrary files. Once uploaded, the attacker may be able to have the script...

Q-Shop 3.0 - Remote XSS/SQL Injection Vulnerabilities

No description provided by source. 000000 00000 0000 0000 000 00 000000 0000000 0000 000000 00000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00000 0 0 0 0 0 0 0 0 00000 0000 0 0 0 0 00000 0 0 0 0 0 0 0 0 0 0 000 0 0 0 ...

q-news 2.0 - Remote Command Execution Exploit

No description provided by source. Author = FireShot , Jacopo Vuga. Mail = fireshotatautisticidotorg Vulnerability = Remote Command Execution Software = q-news 2.0 Download = http://ovh.dl.sourceforge.net/sourceforge/php-box/2.0nologin.zip Greets to = Osirys for his friendship and his tips, Myral...

PBLang <= 4.99.17.q Remote File Rewriting / Command Execution

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...

Joomla Component com_qpersonel SQL Injection Vulnerability

Exploit for php platform in category web applications :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: |:: General Information |:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability |:: By = Valentin Hoebel |:: Contact = email protecte...

April 2014 Security Bulletin Webcast and Q&A

Today we published the April 2013 Security Bulletin Webcast Questions & Answers page. We answered 13 questions in total, with the majority focusing on the update for Internet Explorer MS14-018 and the Windows 8.1 Update KB2919355. Two questions that were not answered on air have been included on...

March 2014 Security Bulletin Webcast and Q&A

Today we published the March 2014 Security Bulletin Webcast Questions & Answers page. We answered eight questions in total, with the majority focusing on the updates for Windows MS14-016 and Internet Explorer MS14-012. One question that was not answered on air has been included on the Q&A page...

PT-2014-2055 · Mitsubishi · Melsec-Q Series +1

Name of the Vulnerable Software and Affected Versions: MELSEC-Q Series affected versions not specified MELSEC-L Series affected versions not specified Description: The issue is related to an integer overflow in the CPU modules of the MELSEC-Q Series and MELSEC-L Series. This can be exploited by a...

PT-2014-3372

Name of the Vulnerable Software and Affected Versions ImageCMS versions prior to 4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter. Recommendations For...