PT-2021-10712 · Smartwares · Smartwares Home Easy

Name of the Vulnerable Software and Affected Versions: Smartwares HOME easy versions prior to 1.0.9 Description: The issue allows for an unauthenticated database backup download and information disclosure. This could lead to the disclosure of sensitive and clear-text information, potentially...

CVE-2021-31802

NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length...

CVE-2021-31802

NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length...

Logic Flaw Vulnerability in Backup Management Server V2.3 at Hangzhou Hikvision System Technology Co.

Hangzhou Hikvision System Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. A logic flaw vulnerability exists in the Backup Management Server V2.3 of Hangzhou Hikvision Systems Technology Co. that can be exploited by attackers to obtain...

The provided client secret keys are expired.

Challenge Veeam Backup for Microsoft 365 displays one of the following errors: The provided client secret keys are expired. Copy Error: AADSTS7000222: The provided client secret keys are expired. Visit the Azure Portal to create new keys for your app, or consider using certificate credentials for...

WordPress WPvivid Backup and Migration plugin <= 0.9.52 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered in WordPress WPvivid Backup and Migration plugin versions = 0.9.52. Solution Update the WordPress WPvivid Backup and Migration plugin to the latest available version at least 0.9.53...

Qnap Systems QNAP HBS 3 Authorization Issues Vulnerability

Qnap Systems QNAP HBS 3 is an application from China Weilian Qnap Systems. A comprehensive data backup and disaster recovery solution. An authorization issue vulnerability exists in HBS 3 Hybrid Backup Sync that stems from a failure to perform adequate authorization checks. An attacker could use...

Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems backup and restore (CVE-2020-25659)

Summary Vulnerability in python-cryptography may affect IBM Spectrum Protect Plus Microsoft® File Systems backup and restore. Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timi...

New QNAP NAS Flaws Exploited In Recent Ransomware Attacks - Patch It!

A new ransomware strain called "Qlocker" is targeting QNAP network attached storage NAS devices as part of an ongoing campaign and encrypting files in password-protected 7zip archives. First reports of the infections emerged on April 20, with the adversaries behind the operations demanding a...

Command injection

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff...

QNAP Systems HBS 3 安全漏洞

Qnap Systems QNAP HBS 3 is an application from China Weilian Qnap Systems. A comprehensive data backup and disaster recovery solution. An authorization issue vulnerability exists in HBS 3 Hybrid Backup Sync that stems from a failure to perform adequate authorization checks. An attacker could use...

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ur username : "...

Discourse 2.7.0 2FA Bypass

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Date: 14/01/2021 Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ...

The vulnerability of the backup function for momentary database snapshots in MongoDB Cloud Manager, MongoDB Ops Manager, MongoDB Atlas Legacy Backups, and the document-oriented database management system MongoDB allows a hacker to trigger a service failure.

The vulnerability of the backup function for instant snapshots of MongoDB Cloud Manager, MongoDB Ops Manager, MongoDB Atlas Legacy Backups, and document-oriented database management systems is related to improper handling of conflicting special elements. Exploiting this vulnerability can allow an...

Granular AWS Account Permissions for Adding an S3 Repository

This article documents the granular permissions required to add an S3 repository to Veeam Backup for AWS...

Veeam Backup for Nutanix AHV possible backup corruption

Challenge Due to a known issue in rare cases Veeam Backup for Nutanix backups might get corrupted. Cause The issue appears on data read by libaio when memory is aligned by 512 bytes but not aligned by 4096 bytes. The issue can affect full backups as well as incremental ones. Solution The issue is...

AWS User Account Permissions for Deployment of Veeam Backup for AWS Appliance

This article documents the granular permissions needed for deploying a new Veeam Backup for AWS appliance...

Granular AWS Account Permissions for Connection to and Upgrading of Veeam Backup for AWS Appliance

This article documents the granular permissions needed for connecting to an existing Veeam Backup for AWS appliance...

CVE-2021-3473

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...

Default credentials

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...