Veeam.Archiver.Service terminates due to 'System.OutOfMemoryException' after updating to Veeam Backup for Microsoft 365 7.0.0.3968

Challenge Veeam.Archiver.Service consumes all available virtual memory and then terminates. The issue can be confirmed with the following Windows Events System log: The Veeam Backup for Microsoft 365 Service service terminated unexpectedly. It has done this 1 times. The following corrective actio...

FAQ: How does Malwarebytes ransomware rollback work?

As the old cybersecurity saying goes: "Its not if, but when." Everyone and their grandma have repeated this foreboding maxim about the nature of ransomware attacks, but sadly, that doesn't make it any less true. Time and again were reminded that ransomware can slip past even the best defenses...

FC-Only Nimble Array Snapshot Failures in Veeam Backup & Replication P20230718

Challenge When using Veeam Backup & Replication 12 P20230718, rescan, backup, and restore operations may fail when the Nimble array is configured to only use Fibre Channel FC protocol. The request could not be understood by the server. Unexpected argument 'multiinitiator'. Solution A private fix ...

CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforc...

ZKTeco BioTime Security Breach

ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime v8.5.5 that could allow an unauthenticated attacker to read sensitive backup files and access sensitive information such as user...

CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforc...

SSH Connection Failure to Linux Machine Requiring Multiple Sequential AuthenticationMethods

Challenge Connections to a Linux machine fail with the following errors: Authentication was partially successful, but server requires additional authentication with: 'password'. No suitable authentication method is supported. Supported methods: 'password'. Some tasks may not display these errors...

Moxa EDS-G512E improper password storage in backup files (CVE-2017-13701)

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method. This plugin only works with...

Possible Impacts of Removing the Machine Where Veeam Is Installed From a Domain

Purpose This article documents the most common side-effects customers may experience when removing the machine where Veeam Backup & Replication is installed from a domain. Solution Not all of the issues listed below may be experienced. These are all heavily dependent on the configuration of the...

PT-2023-4124

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.5 Description The issue is related to insecure access control in the ZKTeco BioTime platform, which can be exploited by sending a specially crafted HTTP request. This allows an unauthenticated attacker to gain...

MAL-2023-8020 Malicious code in developer_backup_test525 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 801d93e817d2a88be92c4ce8b23fb15ec2a02dba59eea3666d03eee45d2dd072 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test524 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d66391b0bfaae30b4461ff1768362862ffcdeb67b1ceb87a4d9b18ec5af4b4a9 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

WordPress Backup Migration Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Backup Migration Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c3aab82cdff1 Credits WordFence Required privilege...

WordPress Backup Migration Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Backup Migration Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ce79e63ce100 Credits Wordfence Required...

Release Information for Veeam Backup for Red Hat Virtualization 3b

Requirements The Veeam Backup for Red Hat Virtualization 3b Plug-In may be used as part of a new deployment or to upgrade an existing Veeam Backup for Red Hat Virtualization Plug-In running versions 2.x - 3.x. After installing the Veeam Backup for Red Hat Virtualization 3b Plug-In, the...

Backup Repository in Invalid State - Causes and Troubleshooting Advice

This article is an extension of the Invalid State page within the Veeam Backup for Microsoft 365 User Guide. Purpose This article documents possible causes for a Veeam Backup for Microsoft 365 Backup Repository to be listed as having an Invalid status and provides troubleshooting advice. Note:...

Virtuozzo Hybrid Server 7.5 Update 5 (7.5.5-249)

Virtuozzo Hybrid Server 7.5 Update 5 introduces new features and provides stability and usability bug fixes. Additionally, it provides a new kernel 3.10.0-1160.90.1.vz7.200.7. Vulnerability id: PSBM-148279 Live migration of Windows 2008 Server R2 virtual machines between Virtuozzo Hybrid Server 7...

Amanda 参数注入漏洞

Amanda is an automated network disk archiver organized by the University of Maryland at College Park. Allows IT administrators to set up a single primary backup server to back up multiple hosts to tape drives/converters or disks or optical media over a network. A security vulnerability exists in...

CVE-2022-46901

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This...

CVE-2022-46900

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs that are executed on the server at specified intervals, e.g., backup, etc. An authenticated user has the ability to...