18119 matches found
LaborOfficeFree Catalog Disclosure
The vulnerability of the backup catalog for LaborOfficeFree software for shift management and overtime tracking is related to lack of access control. Exploiting this vulnerability could allow an attacker to disclose the protected information...
Job For .local Domain Fails When Using Ubuntu-base VMware Backup Proxy
Challenge Backup of VMware VMs fails when using an Ubuntu-based Linux VMware Proxy, and the VMware environment is added to Veeam with an FQDN ending in .local e.g., esxi.somedomain.local. In the Task Log, errors related to NFC connectivity can be found: Processing Error: NFC storage connection is...
VulnCheck KEV: CVE-2023-6266
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMIBACKUP case of the handledownloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download...
WordPress WPvivid Backup for MainWP Plugin <= 0.9.32 is vulnerable to Cross Site Scripting (XSS)
Software WPvivid Backup for MainWP Type Plugin Vulnerable versions = 0.9.32 Fixed in 0.9.33 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35664 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e6744843cdb4 Credits Yudistira Arya...
CVE-2024-34004 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include...
CVE-2024-34004 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include...
CVE-2024-34003 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include...
CVE-2024-34002 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include...
CVE-2024-4469 Migration Backup Restore < 3.5.0 - Admin+ SSRF
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...
CVE-2024-4469 Migration Backup Restore < 3.5.0 - Admin+ SSRF
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...
PT-2024-18376 · G Data · G Data Total Security
Name of the Vulnerable Software and Affected Versions: G DATA Total Security affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privilege...
Backup fails with "Invalid argument Asynchronous request operation has failed. Failed to open storage for read/write access"
Challenge When attempting to write a restore point VBK or VIB to a Linux repository with a 4k logical block size, the task fails with the error: Invalid argument Asynchronous request operation has failed. Failed to open storage for read/write access Cause This error occurs when the storage device...
VSS Snapshot Creation Delay on Server with DFSR Enabled
Article Applicability The issue described in this article affects earlier versions of Veeam Agent for Microsoft Windows VAW, however, the solution provided will only work with VAW 6.1.2 and higher. Challenge When backing up a server with the DFS feature enabled, the VSS snapshot creation step in...
CVE-2024-4469: Server-Side Request Forgery (SSRF)
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...
G DATA Total Security Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the G DATA...
G DATA Total Security Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the G DATA...
PT-2024-18377 · G Data · G Data Total Security
Name of the Vulnerable Software and Affected Versions: G DATA Total Security affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privilege...
JetBrains TeamCity Cross-Site Scripting Vulnerability
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A cross-site scripting vulnerability exists in...
CVE-2024-3412
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstgprocessing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, wi...
