CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

CVE-2015-8780

Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury...

Directory traversal

Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury...

CVE-2015-8780

The CVE-2015-8780 entry concerns Samsung wssyncmlnps before 2015-10-31, where Kies restore contains a directory traversal flaw (ZipFury). The vulnerability exists in Samsung wssyncmlnps Kies restore prior to the given date and could allow an attacker to write arbitrary files. Connected CNVD entry...

Unauthorized Access Vulnerability in Multiple ACTi Products

ACTi I Series, etc. is a series of network surveillance cameras from ACTi. An unauthorized access vulnerability exists in multiple ACTi products due to a failure to properly restrict access to the Restore Factory Settings page. A remote attacker can exploit the vulnerability by submitting a speci...

Design/Logic Flaw

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Summary: CVE-2016-9462 affects Nextcloud Server before 9.0.52 and ownCloud Server before 9.0.4. The root cause is inadequate verification of restore privileges during file restoration, allowing a user with read-only access to revert to older versions. Affected components: Nextcloud Server (pre-9....

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

Full VM restore to a new Datacenter cause deletion of production VM if the name of recovered VM will match production VM name

Challenge Production VM will be deleted without warning if following conditions are met: 1. Full VM restore to vCenter Datacenter, different from original VM Datacenter, VM was running under. 2. Name of recovering VM coincide with existing VM in production. Cause Based on VmWare architecture, it...

Discourse: Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks

As an Admin user on Discourse there is a feature to create, upload, and restore backups. Generating a backup creates a tar file consisting of the database as a SQL file and uploaded files from /public/upload/. Having the ability to upload these tar files and restore from them, you can add any fil...

Job Fails with "Retrieved less bytes from the storage [0] than required"

Challenge A Backup or Backup Copy job fails with the error: Retrieved less bytes from the storage 0 than required Symptoms The point may or may not actually be present on the repository when you browse the storage itself. However, the key issue is that the point shows up as 0 B / Incomplete under...

Information Disclosure Via Checkpoint Directory Permission

flink-runtime is vulnerable to information disclosure. The vulnerability can happen because it creates checkpoint directory without specified permission, allowing another user to delete or read files under it. Therefore it can cause restore failure or information disclosure...

No Azure storage accounts can be found

Challenge When attempting to perform a direct restore to Azure through the Veeam Backup & Replication console, or via PowerShell Get-VBRAzureStorageAccount, no storage accounts can be found, or the specified storage account is not returned. Cause The storage accounts specified are blob storage...

Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes

Challenge Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes Cause Note: After installing Update 1, please install the latest update. The package contains two files: Veeam.Backup365.msi and VeeamExplorerForExchange.msi. Prior to installing this update please reboot the Veeam Backup for...

FAQ: Cloud backup of XenMobile managed devices

Is the Worx data encrypted within the backup? If so what is the encryption level? Yes, as Xenmobile uses the iCloud services from Apple for backing up the data: iCloud secures your data by encrypting it when it's sent over the Internet, storing it in an encrypted format when kept on server review...

Restore/SureBackup from old DC restore point fails due to shadow copy expiration

Challenge DC restore results in DSRM boot and event id 1918 from ActiveDirectoryDomainService stating: The shadow copy service cannot restore Active Directory Domain Services because the shadow copy used is too old. Copy Cause The backup of the DC is older than the tombstone period. Active...

WordPress XCloner - Backup and Restore plugin <= 3.1.4 - Authenticated Path Traversal

This plugin is prone to an authenticated path traversal vulnerability. It allows attackers to leverage directory listings to leak otherwise secret file paths to previous backups and acquire full backup contents. Solution Update the plugin to the latest version...

XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal

Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory...