CVE-2020-5797

UNIX Symbolic Link Symlink Following in TP-Link Archer C9USV1180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router...

TP-Link Archer C9 Backlink Vulnerability

Tp-link TP-Link Archer C9 is a wireless router from China P&L Tp-link. A security vulnerability exists in the TP-Link Archer C9USV1180125, which allows an unauthenticated participant with physical and network access privileges to read sensitive files and write to a limited set of files after...

CVE-2020-12510

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for...

Cisco Secure Web Appliance Elevation of Privilege Vulnerability

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS for the Cisco Secure Web Appliance suffers from an operating system command injection vulnerability that stems from insufficient validation of user-supplied web interface and CLI input. The vulnerability can be...

Rclone Security Feature Issue Vulnerability

Rclone is a software from the Rclone team that synchronizes data asynchronously from cloud storage. The software supports Google Drive, Amazon Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Cloudfiles, Google Cloud Storage, Yandex Files and other cloud storage. A security vulnerabilit...

November 19, 2020—KB4586839 (OS Build 17763.1613) Preview

None None...

The vulnerability of Intel SSD microprogramming software, related to insufficient flow management, allows a hacker to gain unauthorized access to protected information.

The vulnerability of Intel SSD microprogramming software is related to insufficient control of the flow of data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

CVE-2020-0584

Buffer overflow in firmware for IntelR SSD DC P4800X and P4801X Series, IntelR OptaneTM SSD 900P and 905P Series may allow an unauthenticated user to potentially enable a denial of service via local access...

Privacy Drive v3.17.0 - (pdsvc.exe) Unquoted Service Path Vulnerability

Exploit Title: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path Exploit Author: Mohammed Alshehri Vendor Homepage: https://www.cybertronsoft.com/ Software Link: https://www.cybertronsoft.com/download/privacy-drive-setup.exe Version: Version 3.17.0 Build 1456 Tested on: Microsoft Windows...

CVE-2019-11634 - Remote Code Execution Vulnerability in Citrix Workspace app and Receiver for Windows

Description of Problem A vulnerability has been identified in Citrix Workspace app and Receiver for Windows that could result in local drive access preferences not being enforced allowing an attacker read/write access to the clients local drives which could enable code execution on the client...

Privacy Drive 3.17.0 Unquoted Service Path

Exploit Title: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path Date: 2020-8-20 Exploit Author: Mohammed Alshehri Vendor Homepage: https://www.cybertronsoft.com/ Software Link: https://www.cybertronsoft.com/download/privacy-drive-setup.exe Version: Version 3.17.0 Build 1456 Tested on:...

Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path

Exploit Title: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path Date: 2020-8-20 Exploit Author: Mohammed Alshehri Vendor Homepage: https://www.cybertronsoft.com/ Software Link: https://www.cybertronsoft.com/download/privacy-drive-setup.exe Version: Version 3.17.0 Build 1456 Tested on:...

opendrive.pl Cross Site Scripting vulnerability OBB-1493388

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2023-3324 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim into following a specially crafted link and execu...

CVE-2020-5795

UNIX Symbolic Link Symlink Following in TP-Link Archer A7USV5200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router...

Design/Logic Flaw

UNIX Symbolic Link Symlink Following in TP-Link Archer A7USV5200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router...

CVE-2020-5795

The CVE-2020-5795 entry concerns TP-Link Archer A7 (US) V5_200721, where UNIX Symbolic Link (Symlink) Following allows an authenticated admin with physical and network access to execute arbitrary code after inserting a crafted USB drive. Connected records (e.g., CNVD-2020-63194 and Red Hat/other ...

This Week in Security News: US Cyber Command Exposes New Russian Malware and REvil Ransomware Gang ‘Acquires’ KPOT Malware

Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about eight new malware samples that were developed and deployed by Russian hackers in recent attacks. Also, read about how the operators ...

Mail.ru: file read on MCS servers via supplying a QCOW2 image with external backing file

Local file read in mcs.mail.ru by providing QCOW2 disk image with backing image pointing to external file Mail.ru Cloud Solutions allows uploading custom images for disks. This functionality supported QCOW2 disk images. A QCOW2 disk image can have a so-called "backing image" - a file to read...

Scammers Abuse Google Drive to Send Malicious Links

Scammers are leveraging a legitimate Google Drive collaboration feature to trick users into clicking on malicious links. According to reports,, the recent attack stems from Google Drive’s legitimate collaboration feature, which allows users to create push notifications or emails that invite peopl...