CVE-2024-40710

A series of related high-severity vulnerabilities, the most notable enabling remote code execution RCE as the service account and extraction of sensitive information savedcredentials and passwords. Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-38650

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server...

CVE-2024-39715

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-40718

A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-39715

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...

CVE-2024-38650

CVE-2024-38650 affects Veeam Service Provider Console (VSPC) server. It describes an authentication bypass allowing a low-privileged attacker to access the NTLM hash of the service account on the VSPC server. The vulnerability is addressed in VSPC by an update: fixed starting with Veeam Service P...

CVE-2024-42023

CVE-2024-42023 affects Veeam ONE (and related Veeam products) and is disclosed in the Veeam security bulletin. The issue is described as an improper access control allowing a low-privileged user to remotely execute code with Administrator privileges. Affected line in the bulletin notes that Veeam...

CVE-2024-40718

CVE-2024-40718 is an SSRF-based vulnerability that lets a low-privileged user escalate to the local system in Veeam products. Affected components include Veeam Backup & Replication (older 12.x builds like 12.1.2.172 and earlier), Veeam Agent for Linux (<= 6.2.0.101), Veeam ONE (12.1.x), Veeam ...

CVE-2024-40709

A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level...

CVE-2024-38651

CVE-2024-38651 affects Veeam Service Provider Console (VSPC); a low-privileged user can overwrite files on the VSPC server, enabling remote code execution. The vulnerability is listed under VSPC issue details and is addressed in VSPC 8.1 (build 8.1.0.21377). Exploit status is not detailed in the ...

CVE-2024-38650

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server...

CVE-2024-39718

CVE-2024-39718 is a vulnerability in Veeam Backup & Replication 12.x (notably affected builds include 12.1.2.172 and earlier) where a low-privileged user can remotely remove files with the service account’s permissions due to improper input validation. Connected sources confirm this CVE affects m...

CVE-2024-38651

A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server...

CVE-2024-39714

CVE-2024-39714 – Veeam Service Provider Console (VSPC) Connected sources confirm a code-injection vulnerability in VSPC that allows a low-privileged user to upload arbitrary files to the server, resulting in remote code execution on the VSPC server. The issue is documented across multiple feeds w...

CVE-2024-40712

A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation LPE...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from contains a code injection vulnerability that allows a low-privileged user to overwrite files o...