CVE-2023-6553: Improper Control of Generation of Code

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote...

Restoration with backup file doesn't work issue

Restore by backup file does not work correctly in NetScaler...

Bazarr Path Traversal Vulnerability

Bazarr is a software from Bazarr, a companion application to Sonarr and Radarr that manages and downloads subtitles according to your requirements. A path traversal vulnerability exists in Bazarr versions prior to 1.3.1, which stems from a path traversal vulnerability in the component...

PT-2023-31517

Name of the Vulnerable Software and Affected Versions Bazarr versions prior to 1.3.1 Description Bazarr manages and downloads subtitles. The issue arises from the /system/backup/download/ endpoint in bazarr/app/ui.py, where the filename variable, controlled by the user, is not validated and is us...

Rescan of Cloud Native Machines in Azure Fails After Credentials Change

Challenge After the Azure Storage account is changed, rescan of Cloud Native Agents e.g., Veeam Agent for Microsoft Windows , Veeam Agent for Linux fails with the error: Warning Failed to connect to Details: Azure REST API error. HTTP code: 403. Azure error: AuthenticationFailed. Full error:...

CVE-2023-50017

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/database/backup...

CVE-2023-50017

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/database/backup...

CVE-2023-50017

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/database/backup...

Cross site request forgery (csrf)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/database/backup...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system. A cross-site request forgery vulnerability exists in Dreamer CMS v4.1.3, which stems from the component /admin/database/backup not adequately verifying whether a request comes from a trusted user, and can be exploited by an attacker to forge a...

Phoenix WinPhlash Privilege Escalation

The vulnerability of the BIOS loading, backup, and recovery utility for the Phoenix WinPhlash flash device previously known as Phoenix SecureCore Tiano WinFlash is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges...

CVE-2023-50017: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/database/backup...

PT-2023-31456 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/database/backup component. This allows for unauthorized actions to be performed on the system. Recommendations: For Dreamer CMS...

Script to Automate Implementation of Security & Compliance Analyzer Recommendations

Article Applicability This article and its script are relevant to Windows-based deployments of Veeam Backup & Replication. Purpose This article provides information regarding automating the configuration of the Veeam Backup Server according to practices suggested in the Security & Compliance...

Exploit for CVE-2023-6553

CVE-2023-6553 Exploit V2 🚀 Description 📝 The Backup Migra...

CVE-2023-48791

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argument...

CVE-2023-48791

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argument...

CVE-2023-41673

An improper authorization vulnerability CWE-285 in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests...

CVE-2023-40716

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...

Command injection

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argument...