Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Monthly Archives: May 2015
CVE-2012-6691
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.
CVE-2015-1188
The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
CVE-2015-3990
The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
CVE-2015-3999
Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
CVE-2015-4016
The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.
New ASUS ZenPad to come with Avast Mobile Security
ASUS partners with Avast
ASUS, the third largest consumer notebook vendor in the world, has selected Avast Mobile Security to be pre-loaded on its new line of Android powered tablets.
These tablets, called ZenPad, will be debuted at the upcoming Computex in Taiwan this June. The much anticipated 7-inch ZenPad 7 will give customers 12 months of Avast Mobile Security and allow free access to premium versions of Avast Backup and Avast Anti-theft.
“Avast is honored to collaborate with ASUS to provide consumers with the security to remain worry free in today’s always-on and always-connected world,” said Vince Steckler, CEO at Avast. “Consumers are relying on tablets for personal computing more than ever before, and storing massive data and information on these devices. With Avast Mobile Security preloaded on ASUS devices, today’s mobile consumer can have peace of mind browsing the Internet, knowing their devices and personal data are protected across a wide range of threats from malware to Wi-Fi hacks.”
Details of the ASUS ZenPad 7 have been leaked and are reported to have the following specs:
- 7-inch IPS display screen
- 1024 x 600 pixel resolution
- Intel Atom x3
- 1 GB RAM
- 8 GB/16 GB built-in storage
- MicroSD card slot
- Front/back cameras
- Wi-Fi and Bluetooth
Other models with Avast Mobile Security pre-installed include Z300C, Z380/CX, Z370C and Z370CG.
Avast Mobile Security is top-rated by users on Google Play Store and by independent testing organizations including AV-Test and AV-Comparatives. In addition to being available preloaded on ASUS tablets, Avast solutions are available on Google Play and in the Apple Store.
Comodo GeekBuddy Local Privilege Escalation
Comodo GeekBuddy, which is bundled with Comodo Anti-Virus, Comodo Firewall, and Comodo Internet Security, runs a passwordless, background VNC server and listens for incoming connections. This can allow for at least local privilege escalation on several platforms. It also may be remotely exploitable via CSRF-like attacks utilizing a modified web-based VNC client (eg. a Java VNC client).
Navigate – Moderately Critical – Multiple Vulnerabilities – Unsupported – SA-CONTRIB-2015-112
- Advisory ID: DRUPAL-SA-CONTRIB-2015-012
- Project: Navigate (third-party module)
- Version: 6.x, 7.x
- Date: 2015-May-20
- Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
- Vulnerability: Cross Site Scripting, Access bypass
Description
Navigate is a customizable navigation tool for Drupal.
Access Bypass
In certain situations the module does not adequately check content permissions, allowing a malicious user with “navigate view” permission to modify custom widgets and create new widget database records.
Cross-site scripting
The module also doesn’t sufficiently filter text, creating an XSS vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permissions “navigate view”, “navigate_custom use” and either “navigate customize” or “navigate administer”.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance
with Drupal Security Team processes.
Versions affected
All versions of Navigate module.
Drupal core is not affected. If you do not use the contributed Navigate module,
there is nothing you need to do.
Solution
If you use the Navigate module you should uninstall it.
Also see the Navigate project page.
Reported by
Fixed by
Not applicable.
Coordinated by
- Michael Hess of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Shipwire – Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-111
- Advisory ID: DRUPAL-SA-CONTRIB-2015-111
- Project: Shipwire (third-party module)
- Version: 7.x
- Date: 2015-May-20
- Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All
- Vulnerability: Information Disclosure
Description
The Shipwire API module handles communication with the Shipwire shipping service.
The Shipwire module doesn’t check view permission for the shipments overview page when installed (admin/shipwire/shipments). Limited non-public information is displayed on the page.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance
with Drupal Security Team processes.
Versions affected
- Shipwire 7.x-1.x versions prior to 7.x-1.03.
Drupal core is not affected. If you do not use the contributed Shipwire module,
there is nothing you need to do.
Solution
Install the latest version:
- If you use the Shipwire module for Drupal 7.x, please upgrade to Shipwire 7.x-1.03 or greater.
- Check the settings have been updated by navigating to Structure -> Views -> Shipwire shipment. Under ‘Page settings’ make sure that ‘Access’ is set to ‘Permission’ -> ‘View all Shipwire Shipments’.
Also see the Shipwire project page.
Reported by
Fixed by
Coordinated by
- Matt Vance of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity