Multiple cross-site scripting (XSS) vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) default URI to admin.php or the (2) id parameter to admin.php or (3) go.php.
Monthly Archives: November 2014
CVE-2014-4974
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver, aka Personal Firewall module before Build 1212 (20140609), as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls.
How many devices do you have in your home?
It’s probably more than you think. There are the obvious ones such as laptops, tablets and smartphones. But did you think of your smart TV, games console or even your refrigerator? Our homes are very quickly becoming digital environments with dozens of connected devices making up what is known as The Internet of Things.
You may have already heard of devices such as Nest that offer smart solutions to everyday functions like heating your home, but while it may sound futuristic, it is very much part of reality. As an industry, the Internet of Things was already worth well over $30 billion in 2013 and is set to surpass $70 billion by 2018.
The transition to a digitally connected world has well and truly begun. Whether you track your daily activity using a fitness wearable, have your home alarm system linked to your phone or simply stream movies to your television, that’s all part of living in an increasingly connected world.
In an ideal world, this connectivity would be seamless and integrated. In reality though, each of these connected devices are being developed in isolation across dozens of different verticals. The end result is a fractured market that can make it confusing and difficult for you to keep track of all your devices.
There must be an easier way. A simple product that can help you control your personal Internet of Things without the hassle of managing each one individually.
And that’s the idea behind AVG Zen™. We want to make managing your digital world as simple as possible. We want to avoid the culture of countless notifications, constantly prompting you and pulling you back to manage your devices. The idea behind AVG Zen is to offer peace of mind.
The vision is that someday, AVG Zen will help you track all of the devices on your personal Internet of Things. Today, AVG Zen is already a powerful tool that can take much of the hassle out of managing your many devices (and those of your family).
Video
Welcome to AVG Zen
As a central dashboard, AVG Zen allows you to monitor and manage the security and performance of your devices by adding them to your AVG Zen network. It’s an incredibly easy and powerful way to ensure that your PCs, Mac and Android devices are locked down and running smoothly.
That’s AVG Zen – and we are working to ensure it will continue to bring peace of mind to  your connected world as that world continues to grow.
CVE-2014-5387
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php.
CVE-2013-7057
Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that upload arbitrary files via a crafted request to api/v1.0/files/.
CVE-2014-8585
Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php.
CVE-2014-8584
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-8339
SQL injection vulnerability in midroll.php in Nuevolab Nuevoplayer for ClipShare 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ch parameter.
CVE-2014-8586
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
CVE-2014-7176
SQL injection vulnerability in Enalean Tuleap before 7.5 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.