WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion

Exploit Title: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion Date: 11/07/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://www.miniorange.com/ Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/ Version: 1.0.3 Tested on : Window...

Backup and Restore <= 1.0.3 - Admin+ Arbitrary File Deletion

The plugin does not sanitise and validate the foldername parameter when deleting a report, which could allow high privilege users to delete arbitrary files on the web server, including those outside of the WordPress folder POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

Backup and Restore <= 1.0.3 - Admin+ Arbitrary File Deletion

The plugin does not sanitise and validate the foldername parameter when deleting a report, which could allow high privilege users to delete arbitrary files on the web server, including those outside of the WordPress folder PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

WordPress Backup And Restore 1.0.3 Arbitrary File Deletion

Exploit Title: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion Date: 11/07/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://www.miniorange.com/ Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/ Version: 1.0.3 Tested on : Window...

WordPress Backup and Restore plugin <= 1.0.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Murat DEMIRCI in WordPress Backup and Restore plugin versions = 1.0.3. Solution No known fix...

List of Security Fixes and Improvements in Veeam Backup for Nutanix AHV

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup for Nutanix AHV. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help th...

Release Information for Veeam Backup for Microsoft 365 5d Cumulative Patch KB4235

This patch is superseded by Veeam Backup for Microsoft 365 5d Cumulative Patch KB4278 Requirements Please confirm you are running Veeam Backup for Microsoft 365 build 5.0.3.1033 or 5.0.3.1035 prior to installing this Cumulative Patch. You can check this under Help and Support About in Veeam Backu...

exFAT Filesystem May Corrupt Veeam Backup Files

Challenge Testing performed in Veeam labs has determined that, in rare cases, Veeam backups may become corrupted when stored on the exFAT file system. Cause The issue appears to be related to a buffer management issue in the exFAT file system driver. There are no similar issues on other, more...

Replication job fails with "Cannot replicate disk because its capacity was reduced"

Challenge After a VM's disks have been resized to be smaller, the Replication job within Veeam Backup & Replication fails with the following error: Processing Error: Cannot replicate disk Datastore vmfolder/vmname.vmdk because its capacity was reduced Copy Cause This error occurs when Veeam Backu...

WordPress XCloner Backup Plugin Remote Code Execution (CVE-2020-35948)

A remote code execution vulnerability exists in WordPress XCloner Backup plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2021-22488

There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups...

CVE-2021-36995

There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups...

CVE-2021-22488

There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups...

CVE-2021-36995

There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups...

CVE-2021-22488

The CVE-2021-22488 entry concerns an unauthorized file access vulnerability in Huawei smartphones. Exploitation is described as requiring manipulation of soft links, which can tamper with files restored from backups, indicating an impact to file integrity for backup-restore scenarios. Public sour...

Huawei Smartphone 安全漏洞

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. An unauthorized file access vulnerability exists in Huawei Emui and Magic UI that originates from a network system or product that does not properly validate...

Huawei Smartphone 后置链接漏洞

The Huawei Smartphone is a smartphone from the Chinese company Huawei. An authorization issue vulnerability exists in multiple Huawei devices, which stems from the product allowing unauthorized access to certain files. An attacker can exploit the vulnerability to potentially tamper with files...

NAS Recycle Bin impact on Veeam Backup & Replication Repositories

Automatic Recycle Bin Exclusion Starting in Veeam Backup & Replication 12, the storage rescan operation will automatically exclude most recycle bin folders from being scanned. This improvement has reduced the occurrence of issues necessitating this KB article. However, some edge cases may exist...

(0Day) Vinchin Backup and Recovery Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of API access tokens. The issue results from the use of a...

(0Day) Vinchin Backup and Recovery Use of Hard-coded Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of API access keys. The issue results from the use of a hard-cod...