Login or Register to Ask a Question and Join Our Community


Security Advisories (RSS)

S-189: SQL Injectionin Cisco Unified Communications Manager

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) S-189: SQL Injectionin Cisco Unified Communications Manager
# 1  
Old 02-15-2008
S-189: SQL Injectionin Cisco Unified Communications Manager
Cisco Unified Communications Manager is vulnerable to a SQL Injection attack in the parameter key of the admin and user interface pages. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database. The risk is LOW. An authenticated attacker may be able to exploit this vulnerability to extract records from the Cisco Unified Communications Manager database. A successful attack might retrieve sensitive data such as user names, passwords hashes, and information from call records. An attacker cannot use this vulnerability to alter or delete call record information from the database.


More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question

LEARN ABOUT DEBIAN

sql::translator::producer::sqlserver

SQL::Translator::Producer::SQLServer(3pm)		User Contributed Perl Documentation		 SQL::Translator::Producer::SQLServer(3pm)

NAME

       SQL::Translator::Producer::SQLServer - MS SQLServer producer for SQL::Translator

SYNOPSIS

	 use SQL::Translator;

	 my $t = SQL::Translator->new( parser => '...', producer => 'SQLServer' );
	 $t->translate;

DESCRIPTION

       This is currently a thin wrapper around the nextgen SQL::Translator::Generator::DDL::SQLServer DDL maker.

Extra Attributes
       field.list
	   List of values for an enum field.

TODO

	* !! Write some tests !!
	* Reserved words list needs updating to SQLServer.
	* Triggers, Procedures and Views DO NOT WORK

	   # Text of view is already a 'create view' statement so no need to
	   # be fancy
	   foreach ( $schema->get_views ) {
	       my $name = $_->name();
	       $output .= "

";
	       $output .= "--
-- View: $name
--

" unless $no_comments;
	       my $text = $_->sql();
	       $text =~ s/
//g;
	       $output .= "$text
GO
";
	   }

	   # Text of procedure already has the 'create procedure' stuff
	   # so there is no need to do anything fancy. However, we should
	   # think about doing fancy stuff with granting permissions and
	   # so on.
	   foreach ( $schema->get_procedures ) {
	       my $name = $_->name();
	       $output .= "

";
	       $output .= "--
-- Procedure: $name
--

" unless $no_comments;
	       my $text = $_->sql();
	     $text =~ s/
//g;
	       $output .= "$text
GO
";
	   }

SEE ALSO

       SQL::Translator

AUTHORS

       See the included AUTHORS file: http://search.cpan.org/dist/SQL-Translator/AUTHORS <http://search.cpan.org/dist/SQL-Translator/AUTHORS>

COPYRIGHT

       Copyright (c) 2012 the SQL::Translator "AUTHORS" as listed above.

LICENSE

       This code is free software and may be distributed under the same terms as Perl itself.

perl v5.14.2							    2012-05-10				 SQL::Translator::Producer::SQLServer(3pm)