PT-2024-14451

Name of the Vulnerable Software and Affected Versions WebToffee WordPress Backup & Migration versions 1.4.3 and earlier Description The issue is related to a Missing Authorization vulnerability in WebToffee WordPress Backup & Migration. Recommendations For versions 1.4.3 and earlier, update to a...

WordPress plugin WordPress Backup & Migration security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Weak key derivation for backup file

...

CVE-2024-21754: Use of Password Hash With Insufficient Computational Effort

A use of password hash with insufficient computational effort vulnerability CWE-916 affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged...

CVE-2023-52183: Missing Authorization

Missing Authorization vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.3...

Fortinet Fortigate xss (FG-IR-23-471)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-471 advisory. - An improper neutralization of input during web page Generation 'Cross-site Scripting' vulnerability CWE-79 in FortiOS versi...

Fortinet Fortigate Weak key derivation for backup file (FG-IR-23-423)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-423 advisory. - A use of password hash with insufficient computational effort vulnerability CWE-916 affecting FortiOS version 7.4.3 and...

How to Configure Veeam Intelligent Diagnostics Log Location

Purpose This article documents how to change the location where Veeam Intelligent Diagnostics stores the logs it collects--allowing customers to configure both where those logs are stored temporarily on the Veeam Backup Server before being transferred to the Veeam ONE server and where those logs...

CVE-2024-29849: Veeam discloses Critical Vulnerability that allows attackers to bypass user authentication on its Backup Enterprise Manager web interface

On May 21, 2024, Veeam revealed a severe flaw across its Veeam Backup Enterprise Manager VBEM web interface that enables an unauthenticated attacker to log into the web interface as any user. Officially designated as CVE-2024-29849, the vulnerability presents a major threat with a CVSS V3 rating ...

CVE-2022-45168

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backupcode endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes...

CVE-2022-45168

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backupcode endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes...

Exploit for Improper Authentication in Veeam Veeam_Backup_\&_Replication

CVE-2024-29849 Veeam Backup Enterprise Manager Authentication...

LIVEBOX Collaboration vDesk Security Vulnerability

LIVEBOX Collaboration vDesk is an application from LIVEBOX, Inc. A security vulnerability exists in LIVEBOX Collaboration vDesk v018 and prior versions, which stems from the application allowing a user to generate or regenerate backup code prior to checking TOTP, where a two-factor authentication...

PT-2024-11688 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue allows a Bypass of Two-Factor Authentication under the "/login/backup code" endpoint and the "/api/v1/vdeskintegration/createbackupcodes" endpoint. This occurs because th...

How to Enable Changed Block Tracking for Guest Cluster on vSphere with Tanzu

Purpose Changed Block Tracking is a VMware feature that tracks changes in virtual disks. Veeam Kasten for Kubernetes uses this feature in vSphere with Tanzu Guest Clusters to efficiently back up Persistent Volumes. Enabling Changed Block Tracking in each Supervisor Cluster where Veeam Kasten for...

The vulnerability of the LaborOfficeFree software for managing shift scheduling and working hours, which stems from the use of pre-installed database records, allows a perpetrator to gain unauthorized access to the application’s backup database.

The vulnerability of the executable files LOFservice.exe and LaborOfficeFree.exe of the LaborOfficeFree software for workforce management and time tracking involves the use of pre-installed database credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to...

Citrix Endpoint Management (aka XenMobile Server) 10.15.0 Rolling Patch 7

Package name: xms10.15.0.10731.bin For: XenMobile Server 10.15.0 Deployment type: On-premises only Replaces: xms10.15.0.10624.bin, xms10.15.0.10517.bin, xms10.15.0.10417.bin, xms10.15.0.10327.bin, xms10.15.0.10220.bin, and xms10.15.0.10125.bin Date: June 2024 Languages supported: English US...

ZenML Authorization Issues Vulnerability

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. An authorization issue vulnerability exists in ZenML versions 0.55.4 and below, which stems from an improper backup validation mechanism that could allow an attacker to take over...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 7 (6.0.1-96)

This update provides a stability improvement. Vulnerability id: VSTOR-85872 A stability fix for Backup Gateway...

CVE-2024-35664

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WPvivid Team WPvivid Backup for MainWP allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through 0.9.32...