Discourse: Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks

As an Admin user on Discourse there is a feature to create, upload, and restore backups. Generating a backup creates a tar file consisting of the database as a SQL file and uploaded files from /public/upload/. Having the ability to upload these tar files and restore from them, you can add any fil...

Job Fails with "Retrieved less bytes from the storage [0] than required"

Challenge A Backup or Backup Copy job fails with the error: Retrieved less bytes from the storage 0 than required Symptoms The point may or may not actually be present on the repository when you browse the storage itself. However, the key issue is that the point shows up as 0 B / Incomplete under...

Information Disclosure Via Checkpoint Directory Permission

flink-runtime is vulnerable to information disclosure. The vulnerability can happen because it creates checkpoint directory without specified permission, allowing another user to delete or read files under it. Therefore it can cause restore failure or information disclosure...

No Azure storage accounts can be found

Challenge When attempting to perform a direct restore to Azure through the Veeam Backup & Replication console, or via PowerShell Get-VBRAzureStorageAccount, no storage accounts can be found, or the specified storage account is not returned. Cause The storage accounts specified are blob storage...

Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes

Challenge Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes Cause Note: After installing Update 1, please install the latest update. The package contains two files: Veeam.Backup365.msi and VeeamExplorerForExchange.msi. Prior to installing this update please reboot the Veeam Backup for...

FAQ: Cloud backup of XenMobile managed devices

Is the Worx data encrypted within the backup? If so what is the encryption level? Yes, as Xenmobile uses the iCloud services from Apple for backing up the data: iCloud secures your data by encrypting it when it's sent over the Internet, storing it in an encrypted format when kept on server review...

Restore/SureBackup from old DC restore point fails due to shadow copy expiration

Challenge DC restore results in DSRM boot and event id 1918 from ActiveDirectoryDomainService stating: The shadow copy service cannot restore Active Directory Domain Services because the shadow copy used is too old. Copy Cause The backup of the DC is older than the tombstone period. Active...

XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal

Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory...

WordPress XCloner - Backup and Restore plugin <= 3.1.4 - Authenticated Path Traversal

This plugin is prone to an authenticated path traversal vulnerability. It allows attackers to leverage directory listings to leak otherwise secret file paths to previous backups and acquire full backup contents. Solution Update the plugin to the latest version...

XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal

Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory...

WordPress Restore Dropbox plugin <= 1.4.7 - PHP Object Injection Vulnerability

WordPress Restore Dropbox plugin allows a possible PHP Object Injection vulnerability in wpadmunpack function. Solution Update the plugin...

WordPress Backup & Restore Dropbox plugin <= 1.4.7 - Authenticated Information Disclosure Vulnerability

WordPress Restore Dropbox plugin has a PHP object injection vulnerability. The plugin’s admin functions are accessible to any logged in user. Solution Update the plugin...

Release Notes for Veeam Management Pack 8.0 Update 3

Challenge Release Notes for Veeam Management Pack 8.0 Update 3 Cause Please confirm you are running Veeam Management Pack 8.0 prior to installing this update. You can check this in Operations Manager console under Administration | Management Packs, the build number should be 8.0.0.2218 or later. ...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)

// // This exploit uses the pokemon exploit of the dirtycow vulnerability // as a base and automatically generates a new passwd line. // The user will be prompted for the new password when the binary is run. // The original /etc/passwd file is then backed up to /tmp/passwd.bak // and overwrites t...

WordPress XCloner 3.1.5 Denial Of Service / Code Execution

Exploit Title: XCloner = 3.1.5 Multiple Vulnerabilities Google Dork: inurl:"plugins/xcloner-backup-and-restore/readme.txt" -site:wordpress.org Date: 08/11/2016 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: www.xcloner.com Software Link:...

CID Mismatch in VMware on Restore with Backup and Replication V9 installed on Server 2008R2

Challenge Upon restore using Veeam Backup and Replication V9X you receive a CID mismatch error when you are on vSphere 5.5 Update 3b Cause This is a known issue with restoring with the option to use VM tags is enabled in vSphere 5.5 Update 3b Solution Known workarounds: 1. Upgrade Backup and...