EUVD-2019-2268

Malware in sbrugna...

EUVD-2019-2267

Malware in sbrugna...

CVE-2019-10264

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE...

CVE-2019-10265

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to for example "C:" then one can browse the whole server...

CVE-2019-10263

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account...

CVE-2019-10267

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

Ahsay Systems Cloud Backup Suite Arbitrary File Upload Vulnerability

Ahsay Systems Cloud Backup Suite is a centralized cloud backup solution from Ahsay Systems in Hong Kong, China. The product supports features such as database backup and physical server backup. A security vulnerability exists in Ahsay Systems Cloud Backup Suite version 8.3.0.30. The vulnerability...

CVE-2020-5846

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file in...

PT-2020-18754

Name of the Vulnerable Software and Affected Versions Ahsay Cloud Backup Suite version 8.3.0.30 Description An issue was discovered in Ahsay Cloud Backup Suite, allowing for insecure file upload and code execution. This can be achieved via a "PUT /obs/obm7/file/upload" request, where the...

CVE-2020-5846: Unrestricted Upload of File with Dangerous Type

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file in...

CVE-2019-10267

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

CVE-2019-10265

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to for example "C:" then one can browse the whole server...

Design/Logic Flaw

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

CVE-2019-10267

CVE-2019-10267 affects Ahsay Cloud Backup Suite 8.1.0.50 . The vulnerability is an insecure file upload that allows placing a file in any server directory; an attacker can upload a JSP shell to the web root and execute it, resulting in full access to the system under the configured user (e.g., Ad...

CVE-2019-10266

Affected product: Ahsay Cloud Backup Suite prior to 8.1.1.50. Issue: unauthenticated, out-of-bounds XML input can trigger XML External Entity (XXE) processing, enabling an attacker to read file structures and contents from the server. Root cause: improper handling of XML input leading to informat...

CVE-2019-10265

CVE-2019-10265 affects Ahsay Cloud Backup Suite prior to 8.1.1.50. The vulnerability exists on the /cbs/system/ShowAdvanced.do “File Explorer” screen, where input in the JavaScript code can change the directory to an arbitrary path (e.g., C:), enabling an attacker to browse the server filesystem....

CVE-2019-10264

The affected product is Ahsay Cloud Backup Suite prior to 8.1.1.50. With a valid administrator account, the Move / Import / Export Users screen’s Import Users option accepts a ZIP archive containing a users.xml file, which can trigger an XML External Entity (XXE) vulnerability. This impacts multi...

CVE-2019-10263

CVE-2019-10263 affects Ahsay Cloud Backup Suite prior to 8.1.1.50. The initial description documents an XSS vulnerability in the Alias field during trial account creation that could lead to an admin cookie theft and account takeover. Multiple connected sources corroborate the Ahsay exposure and s...

PT-2019-11671

Name of the Vulnerable Software and Affected Versions Ahsay Cloud Backup Suite versions prior to 8.1.1.50 Description An issue allows reading the file structure and content of files without authentication by sending an out-of-bounds XML document to a URL. Recommendations For versions prior to...

PT-2019-11672

Name of the Vulnerable Software and Affected Versions Ahsay Cloud Backup Suite version 8.1.0.50 Description An issue was discovered that allows for insecure file upload and code execution. It is possible to upload a file into any directory of the server, including inserting a JSP shell into the w...