CVE-2016-2809

The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution...

OTA updater - External URLs, Possible privilege escalation, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application OTA updater published at the 'play' market has multiple vulnerabilities...

Limesurvey Unauthenticated File Download

This module exploits an unauthenticated file download vulnerability in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded as a ZIP and unzipped automatically, thus binary files can be downloaded. Module Options msf use auxiliary/admin/http/limesurvey/filedownload msf...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to read arbitrary files

The vulnerability of the updater.exe component in Firefox and Firefox ESR browsers is related to deficiencies in access control for files. Exploiting this vulnerability allows a malicious actor to read arbitrary files during the software update process...

Mozilla Firefox and Firefox ESR updater.exe Privilege Bypass Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in the Mozilla Firefox updater.exe file that allows local attackers to perform a symbolic link attack to write arbitrary files at program startup...

Drupal CMS Updater Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP.CMS Updater module for Drupal is a module for Drupal that provides security protection for Drupal websites. A cross-site scripting vulnerability in the Drupal CMS Updater module 7.x-1.3 prior to version 7.x-1.x allows...

Drupal CMS Updater Module Security Restriction Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP.CMS Updater module for Drupal is a module for Drupal that provides security protection for Drupal websites. A security restriction bypass vulnerability exists in the Drupal CMS Updater module 7.x-1.3 and prior to 7.x-1.x,...

Microsoft Revokes Leaked D-Link Certificates

Microsoft today revoked trust for the four digital certificates inadvertently leaked last week by networking gear manufacturer D-Link. Microsoft said it has modified its Certificate Trust List removing trust for the four certs, which could have been used to sign malicious code used in attacks. Th...

CVE-2015-4505

updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service...

CVE-2015-4505

updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2015-96 Miscellaneous memory safety hazards rv:41.0 / rv:38.3 MFSA 2015-97 Memory leak in mozTCPSocket to servers MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes MFSA 2015-99 Site attribute spoofing on Android by pasting URL with...

CVE-2015-7306

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

Code injection

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

Cross site scripting

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7306

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

CVE-2015-7307

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7307

The CVE-2015-7307 entry describes a cross-site scripting (XSS) vulnerability in the Drupal CMS Updater module (7.x-1.x) prior to version 7.x-1.3. The issue arises on the module’s configuration page where user-supplied text is not properly sanitized, enabling remote attackers to inject arbitrary w...

CVE-2015-7306

Summary: CVE-2015-7306 affects the Drupal CMS Updater module (7.x-1.x) prior to 7.x-1.3. The vulnerability is a permission check bypass on the settings access page, enabling remote authenticated users to view and modify settings by abusing the "access administration pages" permission. Affected so...

CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150

CMS Updater allows to update Drupal core automatically with a subscription service. Access bypass The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. This vulnerability is mitigated by the fact that an...

The vulnerability of Firefox and Firefox ESR browsers allows attackers to trigger a service failure or increase their privileges.

The vulnerability of the Updater component in Firefox and Firefox ESR browsers is caused by buffer overflow. Exploiting this vulnerability can allow an attacker acting locally to cause service failures or increase their privileges using a specially crafted MAR file...