Design/Logic Flaw

A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The...

BDCOM 1704-WGL 信息泄露漏洞

The BDCOM 1704-WGL is a router from BDCOM China. An information disclosure vulnerability exists in the BDCOM 1704-WGL version 2.0.6314, which originates from the file /param.file.tgz in the component Backup File Handler, which is not sufficiently protected for sensitive information and can be...

PT-2023-16433 · Bdcom · Bdcom 1704-Wgl

Name of the Vulnerable Software and Affected Versions: BDCOM 1704-WGL version 2.0.6314 Description: A critical issue affects the Backup File Handler component, specifically an unknown part of the file /param.file.tgz, leading to information disclosure. The attack can be initiated remotely...

CVE-2023-0658 Multilaser RE057/RE170 Backup File param.file.tgz information disclosure

A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The...

Multilaser RE057 和 RE170 信息泄露漏洞

The Multilaser RE057 and Multilaser RE170 are both a router from Multilaser. An information disclosure vulnerability exists in the Multilaser RE057 and RE170 versions 2.1/2.2 that originates in an unknown portion of the component Backup File Handler, resulting in information disclosure...

PT-2023-16432 · Multilaser · Multilaser Re 170 +1

Name of the Vulnerable Software and Affected Versions: Multilaser RE057 and RE170 versions 2.1/2.2 Description: A critical issue was found in the Backup File Handler component, affecting an unknown part of the file /param.file.tgz. This leads to information disclosure and can be initiated remotel...

VulnCheck KEV: CVE-2022-2551

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...

CVE-2023-22389

Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via Save/Restore–Backup Settings, which could be read by any user accessing the file...

MAL-2023-384 Malicious code in fca-backup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a7307e2fcfdfd54a28ef285f8a2b91d3ac27e726313b0d0a1590d06eddea09f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-backup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a7307e2fcfdfd54a28ef285f8a2b91d3ac27e726313b0d0a1590d06eddea09f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2022-37705

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...

Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats.

Challenge After upgrading Veeam Backup for Microsoft 365 from v5 to v6a, during the next backup run, or when editing the job or organization, the following error occurs: Invalid backup configuration: Team chats backup using protected APIs must the enabled to protect Team chats. Issue Prevention...

How to Restrict Which Azure Subscriptions Are Accessible to an Azure Compute Account

Purpose This article documents how to restrict which subscriptions will be accessible to an Azure Compute account used by Veeam Backup & Replication. Use Case By default, IAM roles are assigned to a newly created Microsoft Entra ID application on all subscriptions visible to the Microsoft Entra I...

CVE-2022-37705

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...

Application-Aware Processing Tasks Fail in a Kerberos-Only Environment After Upgrading to Veeam Backup & Replication 12

Challenge If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error: Failed to connect to guest agent, failing over to guest agent through VIX Failed to connect to guest agent...

CVE-2022-46967

An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory...

Stack overflow

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these...

Stack overflow

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these...

CISA releases advice on how to safeguard K–12 organizations

To help K-12 schools and school districts in their struggle against cybercrime the Cybersecurity & Infrastructure Security Agency CISA has released the report, Protecting Our Future: Partnering to Safeguard K-12 organizations from Cybersecurity Threats. A cybersecurity incident can significantly...

Revenue Collection System 安全漏洞

Revenue Collection System is a land property billing and payment software by Carlo Montero Individual Developer. A security vulnerability exists in Revenue Collection System version v1.0 that stems from improper access control of its /admin/DBbackup/ component allowing an unauthenticated attacker...