CVE-2023-34854

Authenticated remote code execution via backup/restore in HotelDruid...

Syrian Hackers Distributing Stealthy C#-Based Silver RAT to Cybercriminals

Threat actors operating under the name Anonymous Arabic have released a remote access trojan RAT called Silver RAT that's equipped to bypass security software and stealthily launch hidden applications. "The developers operate on multiple hacker forums and social media platforms, showcasing an...

Everest Backup < 2.2.0 - Sensitive Information Exposure via Log File

Description The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 2.2.0 exclusive via the plugin's log file. This makes it possible for unauthenticated attackers to extract...

Restore Entire Bucket to Zadara Object Storage Fails With "Error: Internal error: object key is empty."

Challenge Attempting to perform an Entire Bucket Restore with the the Destination set to New Bucket when using Zadara Object Storage fails with the error: Restore job failed Error: Internal error: object key is empty. ClientId: , BucketName: Cause This issue arises from a problem related to the...

CVE-2023-52185 WordPress Everest Backup Plugin <= 2.1.9 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9...

The vulnerability of the logback receiver component in the logging library Logback, which allows a hacker to trigger a service failure.

The vulnerability of the logback receiver component in the logging library involves the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Exploit for Improper Authentication in Hitachi Vantara_Hitachi_Network_Attached_Storage

CVE-2023-5808 CVE-2023-5808 is an Insecure Direct Object R...

Improper access control

Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces...

CVE-2023-40716

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...

How to Backup and Restore WEM Configuration sets or Settings on Citrix Cloud

To explain how to backup and restore WEM Configuration Sets and Settings on Cloud...

Changes to eDirectory May Not Appear in File Level Restore for OES 2023 and later

Challenge When performing a Linux File Level Restore, using a helper appliance, to restore the database for eDirectory on OES 2023 and higher, the most recent state of the database found within the restore point lacks changes made just before the backup job ran. Cause This happens because the...

UBUNTU-CVE-2023-34854

Authenticated remote code execution via backup/restore in HotelDruid...

Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.0 security update

OpenShift API for Data Protection OADP 1.3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Remote Code Execution

HotelDruid is vulnerable to Remote Code Execution RCE. The vulnerability is via the backup/restore feature. It can lead to compromising Confidentiality, Integrity and Availability of the system...

This Week in Spring - Spring Boot 3.2 edition - November 21st, 2023

Hi, Spring fans! Welcome to another epic installment of This Week in Spring! As amazing as the week's already been, it's all leading up to this Thursday - Thanksgiving day! - when we release Spring Boot 3.2! and yes, I am very grateful. This release is stuffed to the gills with a ton of new...

VulnCheck KEV: CVE-2022-38130

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e.,...

CVE-2023-45283

The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...

CVE-2023-46253

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

Design/Logic Flaw

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...