CVE-2023-28330

CVE-2023-28330: In Moodle, insufficient sanitizing in the backup feature enables an authenticated arbitrary file read. Access to this backup-related capability is restricted by default to teachers, managers, and admins. Connected documents corroborate a backup-file read risk and reference unpatch...

CVE-2023-28330 Moodle: authenticated arbitrary file read through malformed backup file

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

PT-2023-21941 · Veritas · Veritas Netbackup

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions prior to 8.3.0.2 Description: An issue was discovered that allows an unprivileged user to specify a log file path when executing a NetBackup command, potentially leading to the overwrite of existing NetBackup log...

CVE-2023-28330 Moodle: authenticated arbitrary file read through malformed backup file

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

Google Pixel: Cropped or edited images can be recovered

Most of us have a camera on us at all times, and so photo taking and image sharing has become almost ubiquitous. But when sharing an image, you want to have control over what you share. And that might lead you to crop images, or redact parts of them. Maybe you cropped out a person that didn't wan...

After Enabling MFA, Veeam Backup Server Is Listed as Inaccessible in Veeam Service Provider Console

Challenge After enabling multi-factor authentication MFA in Veeam Backup & Replication or Veeam Cloud Connect, that server may become listed as "inaccessible" within Veeam Service Provider Console yet the Veeam Management Agent for VSPC continues to display a "healthy" status. Cause When MFA is...

Moodle 安全漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a risk of arbitrary file reads due to inadequate backup cleanup...

After Upgrade to Veeam Backup & Replication 12, Storage Rescan of IBM HyperSwap Volume Fails

Challenge After upgrading to Veeam Backup & Replication 12, Storage Rescan fails with: Failed to update information about IBM HyperSwap volumes. Please ensure that volumes on both sides of IBM HyperSwap relationships are included in the rescan scope in the storage properties. See KB4380 for...

WordPress BackupWordPress Plugin < 3.13 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xibodevelopment:backupwordpress"; ifdescription...

Exploit for Missing Authentication for Critical Function in Veeam Veeam_Backup_\&_Replication

CVE-2023-27532 POC for CVE-2023-27532 affecting Veeam Backup a...

pfSense Restore RRD Data Command Injection

This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of pfSense prior to version 2.7.0 which allows an authenticated attacker with the "WebCfg - Diagnostics: Backup & Restore" privilege to execute arbitrary operating system commands as the "root"...

Security Bulletin: Vulnerabilites in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client (CVE-2022-4450, CVE-2023-0216, CVE-2023-0401, CVE-2022-4203, CVE-2023-0217)

Summary IBM Spectrum Protect Backup-Archive Client can be affected by vulnerabilities in OpenSSL. Vulnerabilities include disclosure of sensitive information and denial of service, as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-4450...

CVE-2023-28107

Discourse is an open-source discussion platform. Prior to version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a...

CVE-2023-28107 Discourse vulnerable to multisite DoS by spamming backups

Discourse is an open-source discussion platform. Prior to version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a...

CVE-2023-28107 Discourse vulnerable to multisite DoS by spamming backups

Discourse is an open-source discussion platform. Prior to version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a...

CVE-2023-28107

CVE-2023-28107 affects Discourse. Prior to Discourse 3.0.2 (stable) and 3.1.0.beta3 (beta/tests-passed), an administrator could trigger repeated backup requests, exhausting DB connections and potentially impacting multisite clusters. Patches are available in 3.0.2 (stable) and 3.1.0.beta3 (beta/t...

CVE-2023-28107 Discourse vulnerable to multisite DoS by spamming backups

Discourse is an open-source discussion platform. Prior to version 3.0.2 of the stable branch and version 3.1.0.beta3 of the beta and tests-passed branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse. An attacker logged in as an administrator could make multiple requests for backups, which would exhaust all connection...

Quantum DXi Storage With Firmware 3.x Does Not Work with Veeam Backup & Replication 12

Challenge When attempting to add Quantum DXi storage with firmware 3.x to Veeam Backup & Replication, the following error is shown: Failed to StartAgent: Failed to construct ClientAgentProtocol. If the Quantum DXi storage was added to Veeam Backup & Replication prior to upgrading to Veeam Backup ...

MITRE ATT&CK® Mitigations: Thwarting Cloud Threats With Preventative Policies and Controls

As IT infrastructure has become more and more sophisticated, so too have the techniques and tactics used by bad actors to gain access to your environment and sensitive information. That’s why it's essential to implement robust security measures to protect your organization. One way to do this is ...