CVE-2025-29557

CVE-2025-29557 – كشف بيانات الاعتماد عبر واجهة برمجة تطبيقات تكوين البريد في ExaGrid 📝 نظرة عامة عنوان الثغرة : كشف بيانات اعتماد SMTP عبر واجهة برمجة تطبيقات تكوين البريد المنتج : جهاز النسخ الاحتياطي ExaGrid EX10 الإصدارات المتأثرة : 6.3 – 7.0.1.P08 معرف CVE : CVE-2025-29557 الخطورة : عالية ناق...

CVE-2025-29556

CVE-2025-29556 – تجاوز إنشاء حساب مسؤول الأمان في ExaGrid 📝 نظرة عامة عنوان الثغرة : إنشاء غير مصرح به لحساب مسؤول الأمان المنتج : جهاز النسخ الاحتياطي ExaGrid EX10 الإصدار المتأثر : تم اختباره على الإصدار الحالي وقت الإفصاح الإصدارات المتأثرة : 6.3 – 7.0.1.P08 CVE ID : CVE-2025-29556 الخطورة :...

PT-2025-34213 · Exagrid · Exagrid Ex10

Name of the Vulnerable Software and Affected Versions: Exagid EX10 version 7.0.1p02 Description: An XML external entities XXE injection vulnerability exists in the /init API endpoint. An authenticated, unprivileged attacker can achieve information disclosure and privilege escalation by submitting...

Exagrid EX10 安全漏洞

Exagrid EX10 is a backup storage server from Exagrid Corporation, USA. A security vulnerability exists in Exagrid EX10 version 7.0.1p02, which originates from the presence of XML external entity injection in the /init API endpoint, which could lead to information disclosure and elevation of...

CVE-2025-29556: Improper Access Control

ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an...

CVE-2025-29557: Improper Access Control

ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords...

CVE-2025-29557

The ExaGrid EX10 backup storage appliance (versions 6.3 through 7.0.1.P08 ) is vulnerable to Incorrect Access Control within the MailConfiguration API endpoint. Authenticated users with operator-level privileges can issue an HTTP GET request to this endpoint to retrieve sensitive SMTP configurati...