CVE-2024-6384 Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versio...

Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versio...

Fortinet FortiManager和Fortinet FortiAnalyzer 安全漏洞

Fortinet FortiManager and Fortinet FortiAnalyzer are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains AD...

PT-2024-6361 · Mongodb +1 · Mongodb Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: MongoDB Enterprise Server versions prior to 6.0.16 MongoDB Enterprise Server versions prior to 7.0.11 MongoDB Enterprise Server versions prior to 7.3.3 Description: Underprivileged users may download "hot" backup files if they can acquire a...

MongoDB 安全漏洞

MongoDB is a document-oriented database management system from the American company MongoDB. A security vulnerability exists in MongoDB that stems from the fact that if a less privileged user has access to a unique backup identifier, they may be able to download a hot backup file...

Veeam Backup & Replication 12.1.2 Compatibility with vSphere 8.0 U3

Update 2025-03-31 The "Automatic vCLS VM Exclusion" limitation detailed below was resolved starting in Veeam Backup & Replication 12.2. The NSX-T 4.2 support limitation detailed below was resolved, and NSX-T 4.2.1 is supported fully starting in Veeam Backup & Replication 12.3.1. Support Statement...

WordPress Backup and Restore WordPress Plugin <= 1.50 is vulnerable to Broken Access Control

Software Backup and Restore WordPress Type Plugin Vulnerable versions = 1.50 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43268 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ddf7b19926b6 Credits Ananda Dhakal...

WordPress Backup and Restore WordPress Plugin <= 1.50 is vulnerable to Cross Site Request Forgery (CSRF)

Software Backup and Restore WordPress Type Plugin Vulnerable versions = 1.50 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-43269 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bdf38dd59af4 Credits Ananda Dhakal...

Key Takeaways From The Take Command Summit: Unlocking Security Success

As cybersecurity threats continue to evolve, so must our defenses. The recent Rapid7 Take Command Summit provided invaluable insights into preparing for, responding to, and recovering from ransomware attacks. Here are three essential takeaways from the session, "Before, During, & After Ransomware...

CVE-2024-38202

Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security VBS. However, an...

CVE-2024-38202

CVE-2024-38202 describes an elevation of privilege in Windows Update that could allow a user with basic privileges to reintroduce mitigated vulnerabilities or bypass some VBS protections. The vulnerability requires an attacker to coax an Administrator or delegated user into performing a system re...

Windows Update Stack Elevation of Privilege Vulnerability

Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security VBS. However, an...

Key safe security, or the lack of it

A few years back we put a key safe into our office. Previously, we had used a very simple locked cabinet to ensure keys were returned, as before that, keys kept being accidentally taken home. There’s no data of significance kept at the office. Everything is hosted elsewhere, but we could do witho...

The vulnerability of the Acronis True Image software for operating systems running on macOS regarding backup and data restoration capabilities stems from the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows attackers to exploit their privileges.

The vulnerability of the Acronis True Image operating system’s backup and data recovery software for macOS stems from the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability can allow attackers to enhance their privilege...

SUSE CVE-2024-42142

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-switch, Create ingress ACL when needed Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independe...

Amazon Linux 2023 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2023-2024-698)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-698 advisory. MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fixfieldsifneeded under...

Alternative Method for Migrating Backups to Hardened Linux Repository

Please review the information in this article closely before performing any actions documented herein. This article documents a series of steps that if not performed precisely as documented, could result in data loss. Purpose This article documents an alternative method for migrating backups from...

PT-2024-9471 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: A vulnerability in the Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration...

PT-2024-9472 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: The issue is related to insecure deserialization in Veeam Backup & Replication, allowing a low-privileged user to connect to remoting services and exploit this...

PT-2024-9517 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 12.2 Description: A vulnerability in Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability...