PT-2019-12316

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the qid variable in the /index.php?inform/add.html endpoint. Recommendations For version 4.0, avoid using the qid variable in the /index.php?inform/add.html endpoint...

PCI & QID 38598 “Deprecated Public Key Length”

QID 38598 “Deprecated Public Key Length” will be marked as PCI Fail as of November 1, 2018 in accordance with its CVSS score. Under PCI DSS merchants and financial institutions are required to protect their clients' sensitive data with strong cryptography. Strong cryptography is defined in the...

PCI DSS v3.2 & Private IP Address Disclosure

Private IP addresses disclosure such as QID 86247 “Web Server Internal IP Address/Internal Network Name Disclosure Vulnerability” will be marked as a Fail for PCI as of February 1, 2018 in accordance with PCI DSS v3.2. QID 86247 is a PCI Fail according to PCI DSS v3.2 Requirement 1.3.7: 1.3.7 Do...

Qualys Cloud Platform 2.31 New Features

This release of the Qualys Cloud Platform version 2.31 includes updates and new features for AssetView, Cloud Agent, EC2 Connector, Web Application Scanning, Web Application Firewall, and Security Assessment Questionnaire, highlights as follows. AssetView Use custom severities in AV searches and...

Qualys WAS: New Detections for XML External Entities (XXE)

In the new 2017 edition of the OWASP Top 10, XML External Entities XXE make their first appearance at A4 on the list. Qualys is pleased to announce that Qualys Web Application Scanning WAS engine 4.4 includes new detection capabilities for XXE vulnerabilities. About XML External Entities XXE If...

Vulnerability Management vendors and massive Malware attacks (following the Bad Rabbit)

After the latest Bad Rabbit ransomware attack all Top VM vendors Qualys, Tenable, Rapid7 wrote blog posts on this topic on the same day. Two days later Tripwire also published own review. Why do they care? They do not make antiviruses, endpoint protection or firewalls - the common tools against...

Qualys Cloud Suite 8.11 New Features

This new release of the Qualys Cloud Suite, version 8.11, adds several new major features including: Customizable Login Banners New VM features including QID Changelog View, PCAP Scanning in Express Lite subscriptions, Scanning Options, and Timestamps on IG QID’s. PC improvements to File Monitori...

CVE-2008-5998: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ajaxchecklistsave function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the 1 nid, 2 qid, and...

Sql injection

SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands via the qID parameter...

CVE-2008-4713: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands via the qID parameter...

CVE-2008-3788: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 qtitle, 2 qid, and 3 qyear parameters to a search.php, and the 4 email and 5 password parameters to b login.php...

CVE-2008-1039

SQL injection vulnerability in question.asp in PORAR WEBBOARD allows remote attackers to execute arbitrary SQL commands via the QID parameter...

CVE-2008-1039: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in question.asp in PORAR WEBBOARD allows remote attackers to execute arbitrary SQL commands via the QID parameter...

CVE-2007-0663

SQL injection vulnerability in index.php in Eclectic Designs CascadianFAQ 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter, a different vector than CVE-2007-0631. NOTE: The provenance of this information is unknown; the details are obtained solely fr...

CVE-2007-0663: Undefined Security Weakness

SQL injection vulnerability in index.php in Eclectic Designs CascadianFAQ 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter, a different vector than CVE-2007-0631. NOTE: The provenance of this information is unknown; the details are obtained solely fr...

CVE-2005-3942: Undefined Security Weakness

SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter...