June 13, 2017—KB4022725 (OS Build 15063.413 and 15063.414)

None None...

CVE-2017-11405

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

Multiple Cross-Site Scripting (XSS)

Moodle is vulnerable to multiple cross-site scripting XSS attacks. The attacks can be triggered because the file picker module does not properly handle filenames from users, allowing the attackers to upload files with filenames containing malicious code...

Schneider Electric U.motion Builder file_picker remote code execution vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder filepicker. The user-specified upload path is not constrained, so any logged-in user can upload a file to any location in the system that is...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox regression (USN-3260-2)

USN-3260-1 fixed vulnerabilities in Firefox. The update caused the date picker panel and form validation errors to close immediately on opening. This update fixes the problem. We apologize for the inconvenience. Multiple security issues were discovered in Firefox. If a user were tricked in to...

USN-3260-2 firefox regression

USN-3260-1 fixed vulnerabilities in Firefox. The update caused the date picker panel and form validation errors to close immediately on opening. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a...

Mozilla: Sandbox escape allowing file system read access through file picker (MFSA 2017-12)

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

Mozilla: Sandbox escape allowing file system read access through file picker (MFSA 2017-12)

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

UBUNTU-CVE-2017-5454

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

Mozilla Firefox webkitdirectory local files disclosure (CVE-2017-5414)

I have reported three different bugs to Mozilla in the webkitdirectory feature. Luckily the folder picker was only implement in Mozilla's Nightly browser, which is meant to test out new features before landing in the stable version. Bug 1295914 - webkitdirectory could be used to trick users into...

Radio Hack Box - Tool to Demonstrate Vulnerabilities in Wireless Input Devices

The SySS Radio Hack Box is a proof-of-concept software tool to demonstrate the replay and keystroke injection vulnerabilities of the wireless keyboard Cherry B.Unlimited AES. Requirements Raspberry Pi Raspberry Pi Radio Hack Box shield a LCD, some LEDs, and some buttons nRF24LU1+ USB radio dongle...

[ASA-201703-3] firefox: multiple issues

Arch Linux Security Advisory ASA-201703-3 ========================================= Severity: Critical Date : 2017-03-10 CVE-ID : CVE-2017-5398 CVE-2017-5399 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5403 CVE-2017-5404 CVE-2017-5405 CVE-2017-5406 CVE-2017-5407 CVE-2017-5408 CVE-2017-5410...

UBUNTU-CVE-2017-5414

The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2017-5414

The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox 52 and Thunderbird 52...

edreams.jp XSS vulnerability

Vulnerable URL: http://www.edreams.jp/engine/searchEngines/pickers/trainspickerint.jsp?field=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:05 GMT Vulnerability type:| XSS Vulnerability...

Bluetooth Device Picker - Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Bluetooth Device Picker published at the 'play' market has multiple vulnerabilities...

edreams.com XSS vulnerability

Vulnerable URL: http://www.edreams.com/engine/searchEngines/pickers/trainspickerint.jsp?form=trainsSearch=arrivalLocation=3511122426 Details: Description| Value ---|--- Patched:| Yes, at 22.05.2017 Latest check for patch:| 22.05.2017 08:38 GMT Vulnerability type:| XSS Vulnerability status:|...

edreams.com.br XSS vulnerability

Vulnerable URL: http://www.edreams.com.br/engine/searchEngines/pickers/trainspickerint.jsp?form=trainsSearch=arrivalLocation=3511122426 Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:58 GMT Vulnerability type:| XSS Vulnerability status:|...

edreams.com.ve XSS vulnerability

Vulnerable URL: http://www.edreams.com.ve/engine/searchEngines/pickers/trainspickerint.jsp?form=trainsSearch=arrivalLocation=3511122426 Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:58 GMT Vulnerability type:| XSS Vulnerability status:|...

edreams.com.tr XSS vulnerability

Vulnerable URL: http://www.edreams.com.tr/engine/searchEngines/pickers/trainspickerint.jsp?form=trainsSearch=arrivalLocation=3511122426 Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:58 GMT Vulnerability type:| XSS Vulnerability status:|...