CVE-2024-45171

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup file...

CVE-2024-45178

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, du...

PT-2024-31462

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance version 5.2401 Description An issue was discovered due to improper user input validation, making it possible to download arbitrary files from the system via a path traversal attack. Different functionalitie...

CVE-2024-45170

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, acces...

PT-2024-9557 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: The issue is related to an improper input validation vulnerability. This vulnerability allows a low-privileged user to remotely remove files on the system with permission...

PT-2024-9558 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: A vulnerability exists that allows a user with a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication MFA settings and bypass MFA...

PT-2024-9564 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore...

PT-2024-6331 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC affected versions not specified Description: A code injection vulnerability can allow a low-privileged user to overwrite files on the VSPC server, which can lead to remote code execution on the VSPC server...

PT-2024-6472 · Veeam · Veeam Reporter Service +1

Name of the Vulnerable Software and Affected Versions: Veeam Reporter Service affected versions not specified Description: A vulnerability exists in Veeam Reporter Service that allows an attacker to access the NTLM hash of the service account. This attack requires user interaction and data...

CVE-2024-45170: Improper Access Control

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, acces...

PT-2024-5903

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication affected versions not specified Description A deserialization of untrusted data vulnerability exists where a malicious payload can allow an unauthenticated remote attacker to execute arbitrary code RCE on the server...

CVE-2024-45394 Secret encryption vulnerable to brute-force attacks

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVPBytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the...

CVE-2024-45394

The CVE-2024-45394 entry concerns the Authenticator browser extension. In versions 7.0.0 and earlier, user data encryption keys were stored at-rest with AES-256 using EVP_BytesToKey as the KDF, enabling brute-force attacks if an attacker obtains a copy of the user data. Versions 8.0.0 and above a...

CVE-2024-45394 Secret encryption vulnerable to brute-force attacks

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVPBytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the...

Planned Veeam Backup for Microsoft 365 Feature Deprecation

This article is referenced by: Veeam Backup for Microsoft 365 User Guide: Veeam Backup for Microsoft 365 Feature Deprecation Purpose This article documents features and functionalities of Veeam Backup for Microsoft 365 VB365 that will deprecated in a future versions of the product. Veeam is...

How to Use Existing Veeam Backup & Replication PostgreSQL instance for Veeam Backup for Microsoft 365 Deployment

Article Applicability This article documents issues that occur when installing Veeam Backup for Microsoft 365 v8 or higher on the same server as an existing Veeam Backup & Replication v12 or higher deployment that is using the included local PostgreSQL instance. The errors described may also occu...

Veeam Backup & Replication Install Fails with: "A later version of Veeam Explorer for Microsoft Exchange is already installed."

Challenge When attempting to install Veeam Backup & Replication version 12.1, 12.2, or 12.3 on a machine where Veeam Backup for Microsoft 365 version 8 is already installed, the Veeam Backup & Replication install fails with the error: A later version of Veeam Explorer for Microsoft Exchange is...

PT-2024-9158 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.10 and prior to 29.0.7 Nextcloud Enterprise Server versions prior to 27.1.11.8, prior to 28.0.10, and prior to 29.0.7 Description: The issue is related to the insecure storage of confidential informatio...

WordPress Total Upkeep Unauthenticated Backup Downloader

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Total Upkeep Unauthenticated Backup Downloader', 'Description' = %q This module exploits an unauthenticated database backup vulnerabili...

WordPress Simple Backup File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Simple Backup File Read Vulnerability', 'Description' = %q This module exploits a directory traversal vulnerability in WordPress Plugin...