How to Reset Password for Veeam Backup for Salesforce

Purpose This article documents how to reset the password used to access Veeam Backup for Salesforce. Solution 1. Connect to the Veeam Backup for Salesforce machine via SSH 2. Run the script for changing the password: For Veeam Backup for Salesforce version 3: sudo /opt/vbsf/resetpassword.sh For...

Path Traversal - Download remote files by exploiting the backup functionality (Authenticated)

Description The vulnerability found in the backup system allows an Administrator of the CMS to download any files on the remote file system not only backup files by exploiting a "Path Traversal". The vulnerability does not require any user interaction and is very simple to exploit. Proof of Conce...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. An attacker could spoof historical messages from other users, and use a malicious key backup to the user's account unde...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to an impersonation attack. An attacker could spoof historical messages from other users, and use a malicious key backup to the user's account unde...

About the security content of iOS 16.1 and iPadOS 16

About the security content of iOS 16.1 and iPadOS 16 This document describes the security content of iOS 16.1 and iPadOS 16. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

VulnCheck KEV: CVE-2022-26501

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code...

VulnCheck KEV: CVE-2022-26504

Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager SCVMM allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe...

VulnCheck KEV: CVE-2022-26500

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code...

Moodle Memory Execution RCE

The vulnerability in the virtual training environment Moodle is related to the insecure input verification during the restoration of backup files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading the restored file...

Cross-Site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to cross-site scripting. The vulnerability exists in the backup.export.php due to to improper verification of backup files which allows an attacker to export the configuration and re-upload the same file with the admin grant...

Ransomware attack freezes newspaper printing system

Several German newspapers were left unable to release printed versions of their papers after a ransomware attack affected their printing systems. Speaking to BleepingComputer, Uwe Ralf Heer, editor-in-chief of Heilbronn Stimme, said the attack hit the entire Stimme Mediengruppe media group, which...

Vulnerabilities fixed in Oracle MySQL

Vulnerabilities have been fixed in Oracle MySQL. The vulnerabilities allow a malicious party to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User Rights Access to sensitive data Oracle has fixed vulnerabilities i...

MiniDVBLinux 5.4 Configuration Download

MiniDVBLinux 5.4 Config Download Exploit Vendor: MiniDVBLinux Product web page: https://www.minidvblinux.de Affected version: =5.4 Summary: MiniDVBLinuxTM Distribution MLD. MLD offers a simple way to convert a standard PC into a Multi Media Centre based on the Video Disk Recorder VDR by Klaus...

Microsoft File Systems IBM Spectrum Protect Plus Disclosure

The vulnerability of the backup and recovery functions of Microsoft’s file systems in the IBM Spectrum Protect Plus data protection platform is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to...

rdiff-backup Rdiffweb Redirect

The vulnerability in the rdiff-backup Rdiffweb management web interface involves redirecting URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to remotely redirect users to any given URL address...

TP-LINK AX10 Code Injection Vulnerability

TP-LINK AX10 is a router from TP-LINK, China. TP-LINK AX10 version 1.3.1 is vulnerable to a code injection vulnerability, which stems from the ability to execute arbitrary code via a specially crafted backup file. An attacker could use this vulnerability to generate illegal code segments that...

CVE-2022-41574

An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal...

WordPress WPvivid Backup Path Traversal Vulnerability

Wordpress plugin - WPvivid Backup - Version 0.9.76 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timeline of disclosure Thanks & Acknowledgements Reference...

WordPress WPvivid Backup Path Traversal

===== Tempest Security Intelligence - ADV-15/2022 ========================== Wordpress plugin - WPvivid Backup - Version 0.9.76 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview...

Stored XSS and possible RCE/LFI in case of misconfiguration

Description phpmyfaq has a feature to restore from a backup the entire application. An attacker with admin grant can export the configuration and re-upload the same file bypassing all the backend sanitization and controls. Proof of Concept XSS 1. - login as admin 2. - go to backup page 3. - Creat...