PT-2014-2380

Name of the Vulnerable Software and Affected Versions ImageCMS versions prior to 4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to the "admin/admin search/" endpoint. This can be leveraged using CSRF to allow remote...

CVE-2012-6290: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ImageCMS before 4.2 allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to admin/adminsearch/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

CVE-2013-7334: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter, related to CVE-2012-6290...

Cory Support "q" SQL注入漏洞

Cory Support是一款PHP应用。 由于通过"q" GET参数传递到loadsolve.php的输入在被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 Cory Support 1.0 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://coryapp.com/page.php?id=1 // GET MySQL Injection with "q" Parameter in /loadsolve.php 1 : ?php 2 :...

Cisco TelePresence ISDN Gateway D-Channel DoS

According to its self-reported version number, the remote device is affected by a vulnerability that could allow an unauthorized user to cause a denial of service via a specially crafted Q.931 STATUS message. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72184;...

CVE-2014-0660

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

Code injection

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

CVE-2014-0660: Improper Input Validation

Cisco TelePresence ISDN Gateway with software before 2.21.92 allows remote attackers to cause a denial of service D-channel call outage via a crafted Q.931 STATUS message, aka Bug ID CSCui50360...

PT-2014-3755

Name of the Vulnerable Software and Affected Versions Cisco TelePresence ISDN Gateway versions prior to 2.21.92 Description The issue allows remote attackers to cause a denial of service, specifically a D-channel call outage, by sending a crafted Q.931 STATUS message. Recommendations For versions...

[CVE-2014-1238] Cross Site Scripting(XSS) in q-pulse application

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

Antimalware Support for Windows XP and the January 2014 Security Bulletin Webcast and Q&A

Today we’re publishing the January 2014 Security Bulletin Webcast Questions & Answers page. We answered 16 questions in total, with the majority of questions focusing on the Dynamics AX bulletin MS14-004, the update for Microsoft Word MS14-001 and the re-release of the Windows 7 and Windows Serve...

PT-2014-2399

Name of the Vulnerable Software and Affected Versions Media Library Categories plugin version 1.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the bulk parameter to "media-library-categories/add.php" or the q parameter to...

CVE-2012-6630: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 bulk parameter to media-library-categories/add.php or 2 q parameter to media-library-categories/view.php...

Q-Pulse 0.6 Cross Site Scripting

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

Predictions for 2014 and the December 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the December 2013 Security Bulletin Webcast Questions & Answers page. We answered 17 questions in total, with the majority of questions focusing on the Graphics Component bulletin MS13-096, Security Advisory 2915720 and Security Advisory 2905247. We also wanted to note a ne...

MBSA 2.3 and the November 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the November 2013 Security Bulletin Webcast Questions & Answers page. The majority of questions focused on the ActiveX Kill Bits bulletin MS13-090 and the advisories. We also answered a few general questions that were not specific to any of this month’s updates, but that ma...

2013 PCI SSC North America Meeting – Wrap-Up

Coalfire sent the entire team to the meeting in Las Vegas and everyone reported a positive and engaging experience. We hosted our annual dinner where we caught up with clients and friends - a good time was had by all. The most valuable technical information was presented during the Assessors Only...

October 2013 Security Bulletin Webcast, Q&A, and Slide Deck

Today we’re publishing the October 2013 Security Bulletin Webcast Questions & Answers page. We fielded 11 questions during the webcast, with specific bulletin questions focusing primarily on the SharePoint MS13-084 and Kernel-Mode Drivers MS13-081 bulletins. There was one additional question that...

CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...

Design/Logic Flaw

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...