Features of Veeam Backup & Replication may not function when the Veeam Backup Service is run as a user that is not assigned the "Veeam Backup Administrator" role

Article Applicability This article is specific to a situation in which the Veeam Backup Service is set with a "Log On As" other than Local System. Challenge When the Veeam Backup Service is set to use a specific user as the service's "Log On" account, some features may not function correctly if...

How to Add RHEL 8/9 Using NIST 800-171 or DISA STIG Security Profile to Veeam Backup & Replication

Product Enhancement Starting in Veeam Backup & Replication 12.1.2, both DISA STIG and NIST profiles are now natively supported without any need to perform the manual tasks documented in this article. Purpose This article documents the additional procedures required to add a Linux machine to Veeam...

Unitrends Backup DLL Injection Vulnerability

Unitrends Backup is eliminating data loss, ransomware and risk. versions prior to Unitrends Backup 10.5.5 have a DLL injection vulnerability that can be exploited by attackers to escalate privileges from unprivileged users to the system...

Unitrends Backup SQL Injection Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A SQL injection vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Unitrends Backup Arbitrary File Read Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An arbitrary file read vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to read arbitrary files on the system...

Unitrends Backup elevation of privilege vulnerability (CNVD-2021-95938)

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An elevation of privilege vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by a local attacker to execute arbitrary code as an apache user, resulting in an elevation of privilege...

Chikitsa Patient Management System 2.0.2 - (backup) Remote Code Execution Exploit

Exploit Title: Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution RCE Authenticated Exploit Author: 0z09e https://twitter.com/0z09e Vendor Homepage: https://sourceforge.net/u/dharashah/profile/ Software Link:...

Chikitsa Patient Management System 2.0.2 Backup Remote Code Execution

Exploit Title: Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution RCE Authenticated Date: 03/12/2021 Exploit Author: 0z09e https://twitter.com/0z09e Vendor Homepage: https://sourceforge.net/u/dharashah/profile/ Software Link:...

Agent for Windows backup session is reports success but backup fails

Challenge In certain rare circumstances, backup jobs for Windows Machines using "Mode: Managed by backup server" may mark a result as Success, although the job fails because of the network interuption. Impacted Configurations: Backup & Replication version 9.5 or 10 Veeam Agent for Microsoft Windo...

Unitrends Backup Remote Code Execution Vulnerability (CNVD-2021-95939)

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A remote code execution vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to execute arbitrary code as root...

Unitrends Backup elevation of privilege vulnerability (CNVD-2021-95944)

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An elevation of privilege vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which originates from the creation of arbitrary writable files on a privileged vault server, and can be exploited by an attacke...

Unspecified Vulnerability in Unitrends Backup

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A security vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to write malicious files with elevated privileges...

Unitrends Backup SNMP weak password vulnerability

Unitrends Backup is eliminating data loss, ransomware, and risk. versions prior to Unitrends Backup 10.5.5 have an SNMP weak password vulnerability that stems from the SNMP daemon being configured with a weak silent group name, which can be exploited by an attacker to gain snmp control privileges...

Unitrends Backup Formatting String Error Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A format string error vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which stems from the creation of an HTTP request that could trigger a format string vulnerability in a privileged vaultServer...

Unitrends Backup Buffer Overflow Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A buffer overflow vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to cause a denial of service or remote code execution...

Unitrends Backup Injection Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An injection vulnerability exists in Unitrends Backup versions prior to 10.5.5, which can be exploited by an attacker to escalate a wguest user to a postgres user by injecting a command into a PostgreSQL trigger function in...

Last 24 hours -> Running view lists sessions that are actually in stopped state

Challenge Under certain circumstances, the Last 24 hours Running view displays "extra" sessions that are actually in a stopped state. An example where 3 tasks are running, but the "Running" view displays completed stopped tasks. Cause To improve UI responsiveness, some UI data is cached. The issu...

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways of the 1420, 1410D, and 1410 series wireless hardware routers stems from the lack of access control checks. This allows attackers to circumvent security restrictions, gain unauthorized access to protected information, and alter settings.

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways models 1420, 1410D, and 1410 is related to the lack of access control checks during system backup restoration. Exploiting this vulnerability can allow an attacker to bypass security restrictions, gain unauthorized...

CVE-2021-24866

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion...

CVE-2021-43035

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full acces...