151 matches found
CVE-2025-8864
Shared Access Signature token is not masked in the backup configuration response and is also exposed in the ybbackup logs...
CVE-2025-8864
CVE-2025-8864 affects YugabyteDB: a Shared Access Signature (SAS) token is exposed in backup config responses and in yb_backup logs. The issue impacts confidentiality and is rated CVSS v4.0 (MEDIUM, Base 6.8) with ADJACENT attack vector, HIGH privileges required, no user interaction. Affected com...
YugabyteDB 安全漏洞
YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte USA. A security vulnerability exists in YugabyteDB that stems from the exposure of shared access signature tokens in backup configuration responses and ybbackup logs...
PT-2025-32546 · Yb Backup · Yb Backup
Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A Shared Access Signature token is not masked in the backup configuration response and is exposed in the yb backup logs. Recommendations: At the moment, there is no information about a newer versio...
CVE-2025-5945
CVE-2025-5945 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
Dell Unity Storage - "Unable to validate the specified certificate (Error Code: 0x1000100)"
Challenge When attempting to add a Dell Unity Storage Appliance that has been upgraded to firmware version 5.5 to Veeam Backup & Replication or operate backups to such storage, the following error occurs: Unable to validate the specified certificate Error Code: 0x1000100 Cause An investigation by...
CVE-2024-47950
In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings...
CVE-2024-11165
An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the ybbackup log files, exposing the SAS token in plaintext. The leakage occurs during...
CVE-2024-50377
A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability is associated to the backup configuration functionality that by default encrypts the...
CVE-2023-22957
An issue was discovered in libacdes3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root passwor...
CVE-2023-39001
A command injection vulnerability in the component diagbackup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file...
CVE-2021-20170
Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password...
CVE-2014-10069
Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the umauthaccountpassword field...
CVE-2018-20903
cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface SEC-421...
CVE-2003-1482
The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access...
CVE-2025-25758
An issue in KukuFM Android v1.12.7 11207 allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml...
PT-2025-2364 · NetGear · Netgear Fvs336Gv3 +1
Name of the Vulnerable Software and Affected Versions: Netgear FVS336Gv2 affected versions not specified Netgear FVS336Gv3 affected versions not specified Description: The issue concerns a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute...
CVE-2024-56321 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...
CVE-2024-56321 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...