CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

Directory traversal

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-11960

Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in cupload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS...

How to Create Custom Worker Instance IAM Role

The Worker IAM role is used to launch worker instances for backup and restore using S3 repository...

CVE-2020-14971

Pi-hole through 5.0 allows code injection in piholedhcp the Static DHCP Leases section by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.g...

CVE-2020-14971

Pi-hole through 5.0 allows code injection in piholedhcp the Static DHCP Leases section by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.g...

CVE-2020-14971

Pi-hole through 5.0 allows code injection in piholedhcp the Static DHCP Leases section by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.g...

CVE-2020-14971

CVE-2020-14971 affects Pi-hole up to version 5.0, enabling code injection in the piholedhcp component (Static DHCP Leases) by tampering Teleporter backup archives. An attacker can request a limited backup via teleporter.php, receive a .tar.gz, modify the host parameter in dnsmasq.d files inside t...

CVE-2019-14894

A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms...

Remote code execution

A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms...

CVE-2019-14894

CVE-2019-14894 affects the CloudForms Management Engine, specifically versions 5.10 and 5.11. The flaw enables remote code execution through the NFS schedule backup mechanism. An attacker who can log into the management console could execute arbitrary shell commands on the CloudForms server with ...

Deploying Veeam Backup for Microsoft 365 Backup Proxy Server in AWS

Challenge You need to configure an Amazon EC2 instance to act as a Backup Proxy for Veeam Backup for Microsoft 365 in AWS. For example, this may be required for the following reasons: The current proxy/deployment has or will reach configuration maximums. Growth within the Organizations. You need ...

Release Information for Veeam Backup for AWS v2

Requirements IMPORTANT You cannot update Veeam Backup for AWS operating in the Paid edition to version 2.0 from the Veeam Backup for AWS Web UI. To update the product, you must install Veeam Backup for AWS version 2.0 from AWS Marketplace on a new EC2 instance, and then migrate Veeam Backup for A...

(Pwn2Own) Rockwell Automation FactoryTalk View SE Backup Missing Authentication for Critical Function Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of Rockwell Automation FactoryTalk View SE. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of project backups. The issue results from lack of...

Veeam Backup & Replication — Cannot find any supported licenses for current product version.

Challenge When attempting to install a license into Veeam Backup & Replication, the following error occurs: Cannot find any supported licenses for current product version. Cause This error most often occurs when the license file being installed is for an older version of Veeam Backup & Replicatio...

Product update: Virtuozzo Hybrid Server 7.0 Update 14 (7.0.14-249)

The Update 14 for Virtuozzo Hybrid Server 7.0 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1127.8.2.vz7.151.14. Vulnerability id: PSBM-103700 VM migration by a non-root user could fail. Vulnerability id: PSBM-102841 Misconfiguring...

Veeam Cloud Connect jobs fail with "Authentication failed because the remote party has closed the transport stream" error

Challenge After upgrade of Veeam Backup & Replication on the Veeam Cloud Connect service provider's backup server to version 10, tenant jobs may start failing with the following error: "Authentication failed because the remote party has closed the transport stream ". At the same time, the...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...