The TYPO3 extension ke_questionnaire stores answered questionnaires in a publicly reachable directory on the webserver with filenames that are easily guessable. Version 2.5.2 is affected.
Monthly Archives: December 2014
1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting
Swisscom CSIRT discovered a security flaw in the management interface of the Alcatel Lucent 1830 Photonic Service Switch series that allows for cross site scripting attacks. Versions 6.0 and below are affected.
5 Avast Account features that you need to know about
Many Avast users have protected their family member’s computers and mobile devices with Avast Antivirus products. In order to help you manage everyone’s security, our development team created a portal called the MyAvast Account. Our blog, Keep track of your family’s devices using your Avast Account, explains the basics.
Hopefully, you have already looked at your account. If not, click here to do so, https://my.avast.com. Now I’ll point out some important features that you will find useful.
The top 5 features in your Avast Account
- 1. The whole point of the MyAvast Account is to manage multiple devices from a single portal. If you have registered Avast products on multiple devices using multiple email addresses, you can pair these devices and email addresses to your account which lets you see all licenses in one place. You’ll see the license validity and expiration date for each device.
If you get a new device this CyberMonday and want to remove an old one, then you can easily remove the old device from the account. Go to the Device overview page, choose Settings, and delete from the account.
- 2. For all you Android smartphone users out there, the most important feature is our Avast Anti-Theft mobile security application. We improved the design, and also completely revised and simplified the commands.
- To see what I am describing, log into your account > Go to Devices > Click on your smart phone. In this screen you can see the most important commands that allow you to control your device. With one click you can locate your device, mark your device as lost, inform us and send notifications to your “safe” friend, transfer all calls and SMS to a new number, turn the siren on a lost device, or lock the device remotely. If you have Avast Mobile Premium, then you will have additional commands at your disposal. If you suspect your phone has been stolen, you can take a picture of the thief or record audio in addition to other cool options.
- 3. Avast Awards is a redesigned and interactive system where you earn free Avast products by recommending Avast to your friends. For sharing Avast using your own personalized link, carrying out certain tasks, and using our products you will be rewarded Karma points and Badges. For now, you can obtain a license for Avast Internet Security and badges for participating in our community or being a long-term Avast user. In the future, we may offer other premium products, so check back every once in a while.
- 4. Stay informed with our News widget (on the main account page on the bottom right), where you will see news from our blog and Facebook feed. This provides a great overview of security and privacy news. We invite you to follow and Friend us.
- 5. For those of you who like nice design, you will appreciate the updated Metro style of the portal, and your choice of themes. Visit Settings (the gear icon in the top right corner) and apply the one you like best.
Social Media Security is an additional feature that is in beta now. We wrote about it this past summer in the blog, New avast! Account with Facebook Security is here. Join Beta testing.
This feature helps you identify Facebook posts and photos that pose a threat to your privacy, security, and reputation. In addition to your own Facebook profile, we also monitor your friends network to keep you safe and secure.
Our developers and product managers will continue to work on improvements to the MyAvast Account. If you have any questions, comments, or suggestions, do not hesitate to participate in the dedicated Avast forum board. We look forward to your feedback!
Avast Software’s security applications for PC, Mac, and Android are trusted by more than 200-million people and businesses. Please follow us on Facebook, Twitter and Google+.
I2P 0.9.17
I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.
Researcher Releases Database of Known-Good ICS and SCADA Files
A prominent security researcher has put together a new database of hundreds of thousands of known-good files from ICS and SCADA software vendors in an effort to help users and other researchers identify legitimate files and home in on potentially malicious ones. The database, known as WhiteScope, comprises nearly 350,000 files, including executables and DLLs, […]
Fedora 19 Security Update: util-linux-2.23.2-6.fc19
Fedora 20 Security Update: couchdb-1.6.1-4.fc20
Resolved Bugs
1166041 – CVE-2010-5312 jquery-ui: XSS vulnerability in jQuery.ui.dialog title option
1166767 – CVE-2010-5312 couchdb: jquery-ui: XSS vulnerability in jQuery.ui.dialog title option [fedora-all]<br
* Fix CVE-2010-5312 couchdb: jquery-ui: XSS vulnerability in jQuery.ui.dialog title option (rhbz #1166767)
Fedora 20 Security Update: util-linux-2.24.2-2.fc20
Fedora 19 Security Update: xen-4.2.5-6.fc19
Resolved Bugs
1166461 – migrate –debug option can lead to Segmentation fault (core dumped)<br
Excessive checking in compatibility mode hypercall argument translation,
Insufficient bounding of “REP MOVS” to MMIO emulated inside the hypervisor,
fix segfaults and failures in xl migrate –debug
Fedora 19 Security Update: mediawiki-1.23.7-1.fc19
http://www.mediawiki.org/wiki/Release_notes/1.23#MediaWiki_1.23.7
* (bug 66776, bug 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy.
* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user’s common.js under certain circumstances. The user right “editcontentmodel” was added, and is needed to change a revision’s content model.
* (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw HTML, it is not safe to preview wikitext coming from an untrusted source such as a cross-site request. Thus add an edit token to the form, and when raw HTML is allowed, ensure the token is provided before showing the preview. This check is not performed on wikis that both allow raw HTML and anonymous editing, since there are easier ways to exploit that scenario.
* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff.
* (bug 71621) Make allowing site-wide styles on restricted special pages a config option.
* (bug 42723) Added updated version history from 1.19.2 to 1.22.13
* $wgMangleFlashPolicy was added to make MediaWiki’s mangling of anything that might be a flash policy directive configurable.