R-336: XSS and SQL Injection in Cisco CallManager/Unified Communications Manager Logo


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) R-336: XSS and SQL Injection in Cisco CallManager/Unified Communications Manager Logo
# 1  
Old 12-24-2007
R-336: XSS and SQL Injection in Cisco CallManager/Unified Communications Manager Logo

Cisco CallManager and Unified Communications Manager are vulnerable to cross-site Scripting (XSS) and SQL Injection attacks in the lang variable of the admin and user logon pages. The risk is MEDIUM. A successful attack may allow an attacker to run JavaScript on computer systems connecting to CallManager or Unified Communications Manager servers, and has the potential to disclose information within the database.


More...
Login or Register to Ask a Question

Previous Thread | Next Thread

2 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

XSS vulnerability found via injection in the parameter address

Mods please move if posted in wrong section, I wasnt sure where to ask this one. There are several of us that use an open source program called yiimp, https://github.com/tpruvot/yiimp several of our sites were attacked last night and I am reaching out to you guys to see if then vulnerability... (0 Replies)
Discussion started by: crombiecrunch
0 Replies

2. Shell Programming and Scripting

SQL Injection Detection

I want to grep/awk /var/log/httpd/mysite-access_log.log and check if 2 words from the following appear in a single line: benchmark union information_schema drop truncate group_concat into file case hex lpad group order having insert union select from (12 Replies)
Discussion started by: koutroul
12 Replies
Login or Register to Ask a Question
SQL::Translator::Producer::SQLServer(3pm)		User Contributed Perl Documentation		 SQL::Translator::Producer::SQLServer(3pm)

NAME
SQL::Translator::Producer::SQLServer - MS SQLServer producer for SQL::Translator SYNOPSIS
use SQL::Translator; my $t = SQL::Translator->new( parser => '...', producer => 'SQLServer' ); $t->translate; DESCRIPTION
This is currently a thin wrapper around the nextgen SQL::Translator::Generator::DDL::SQLServer DDL maker. Extra Attributes field.list List of values for an enum field. TODO
* !! Write some tests !! * Reserved words list needs updating to SQLServer. * Triggers, Procedures and Views DO NOT WORK # Text of view is already a 'create view' statement so no need to # be fancy foreach ( $schema->get_views ) { my $name = $_->name(); $output .= " "; $output .= "-- -- View: $name -- " unless $no_comments; my $text = $_->sql(); $text =~ s/ //g; $output .= "$text GO "; } # Text of procedure already has the 'create procedure' stuff # so there is no need to do anything fancy. However, we should # think about doing fancy stuff with granting permissions and # so on. foreach ( $schema->get_procedures ) { my $name = $_->name(); $output .= " "; $output .= "-- -- Procedure: $name -- " unless $no_comments; my $text = $_->sql(); $text =~ s/ //g; $output .= "$text GO "; } SEE ALSO
SQL::Translator AUTHORS
See the included AUTHORS file: http://search.cpan.org/dist/SQL-Translator/AUTHORS <http://search.cpan.org/dist/SQL-Translator/AUTHORS> COPYRIGHT
Copyright (c) 2012 the SQL::Translator "AUTHORS" as listed above. LICENSE
This code is free software and may be distributed under the same terms as Perl itself. perl v5.14.2 2012-05-10 SQL::Translator::Producer::SQLServer(3pm)