Veeam ONE Reporter CommandExecutor authenticated RCE

PowerUser+ OAuth token; dashboard schedule reportSettings.command runs as VeeamSvc local Administrators. !/usr/bin/env python3 -- coding: utf-8 -- """Veeam ONE Reporter dashboard schedule CommandExecutor RCE.""" from future import annotations import json import time from kittysploit import from...

Veeam ONE Reporter Authenticated RCE / Privilege Escalation via CommandExecutor — Detect

Fingerprint / reachability check for Veeam ONE Reporter Authenticated RCE / Privilege Escalation via CommandExecutor !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Veeam ONE Reporter Authenticated RCE / Privilege Escalation via CommandExecutor""" from kittysploit import from...

Veeam ONE Reporter 13.1 Remote Code Execution

Veeam ONE Reporter version 13.1 contains an authenticated remote code execution vulnerability in dashboard scheduling. A remote PowerUser can supply an arbitrary command through reportSettings.command, which is subsequently executed without command validation or privilege reduction. Commands...

EUVD-2019-5524

Malware in sbrugna...

EUVD-2019-5525

Malware in sbrugna...

EUVD-2019-3240

Malware in sbrugna...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

Veeam ONE Reporter Cross-Site Scripting Vulnerability

Veeam ONE Reporter is part of the Veeam ONE integrated solution from Veeam Switzerland. The product is used for analytics, decision making, refunds, change tracking, capacity planning and resource utilization optimization. A cross-site scripting vulnerability exists in Veeam ONE Reporter version...

Veeam ONE Reporter Cross-Site Scripting Vulnerability (CNVD-2019-24803)

Veeam ONE Reporter is part of the Veeam ONE integrated solution from Veeam Switzerland. The product is used for analytics, decision making, refunds, change tracking, capacity planning and resource utilization optimization. A cross-site scripting vulnerability exists in Veeam ONE Reporter version...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

Code injection

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

Code injection

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14298: Improper Neutralization of Input During Web Page Generation

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297: Improper Neutralization of Input During Web Page Generation

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

PT-2019-13595

Name of the Vulnerable Software and Affected Versions Veeam ONE Reporter version 9.5.0.3201 Description The issue allows for cross-site scripting XSS attacks via a crafted Description field in the config to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx. This can potentially lead...

PT-2019-13594

Name of the Vulnerable Software and Affected Versions Veeam ONE Reporter version 9.5.0.3201 Description The issue allows for cross-site scripting XSS attacks via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in "CommonDataHandlerReadOnly.ashx" API endpoint. This can...