CVE-2019-6679: Improper Link Resolution Before File Access

On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users wi...

Starbucks: India - OTP bypass on Phone number verification for account creation

dekster discovered a mobile number verification bypass via incorrect client side validation allowing an attacker to validate a new account creation without a valid phone number attached. @dekster — thank you for reporting this vulnerability and for confirming the resolution...

Starbucks: Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11

rugb discovered the endpoint at https://www.starbucks.com.sg/RestApi/ was found vulnerable to XML eXternal Entity XXE processing. This permitted arbitrary reading of files on the remote server. This asset is not rated as critical as it does not contain sensitive data. @rugb — thank you for...

CVE-2019-19693: Improper Link Resolution Before File Access

The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on...

CVE-2019-15006

There was a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence...

Information disclosure

There was a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence...

CVE-2019-15006

CVE-2019-15006 describes a MITM vulnerability in the Confluence Previews plugin used to communicate with the Atlassian Companion app via the atlassian-domain-for-localhost-connections-only.com hostname (DNS to 127.0.0.1). An attacker controlling DNS could observe or modify edited files; the certi...

2019-12 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4530684)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

2019-12 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4530684)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

QNAP Systems QNAP QTS Incorrect Link Resolution Vulnerability

QNAP Systems QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A security vulnerability exists in QNAP Systems QNAP QTS, which is caused by the program not properly resolving links. A...

Seeker v1.2.1 - Accurately Locate Smartphones Using Social Engineering

Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website on In Built PHP Server and uses Serveo to generate a li...

CVE-2019-7183

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

CVE-2019-7183

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

Input validation

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

CVE-2019-7183

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

PT-2019-18458

Name of the Vulnerable Software and Affected Versions QNAP QTS affected versions not specified Description This issue allows remote attackers to access system files due to improper link resolution. Recommendations Update QTS to the latest version...

CVE-2019-7183: Improper Link Resolution Before File Access

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...

QNAP QTS Multiple Vulnerabilities (NAS-201911-27)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; if description...

Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested =1 virtualization is enabled. This high resolution timerhrtimer runs when a L2 guest is active. After VM exit, the syncvmcs12 timer object is stopped. The...

Ghostscript gssetresolution gsgetresolution Data Compromise

The vulnerability of the gssetresolution and gsgetresolution components in the Ghostscript software for document processing, conversion, and generation is related to the presence of unused code. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, an...