Design/Logic Flaw

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462

Summary: CVE-2016-9462 affects Nextcloud Server before 9.0.52 and ownCloud Server before 9.0.4. The root cause is inadequate verification of restore privileges during file restoration, allowing a user with read-only access to revert to older versions. Affected components: Nextcloud Server (pre-9....

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

CVE-2016-9462: Improper Access Control

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...

PT-2017-10153

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue arises from improper verification of restore privileges when restoring a file. Specifically, the restore capability was not checking if a...

Full VM restore to a new Datacenter cause deletion of production VM if the name of recovered VM will match production VM name

Challenge Production VM will be deleted without warning if following conditions are met: 1. Full VM restore to vCenter Datacenter, different from original VM Datacenter, VM was running under. 2. Name of recovering VM coincide with existing VM in production. Cause Based on VmWare architecture, it...

Discourse: Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks

As an Admin user on Discourse there is a feature to create, upload, and restore backups. Generating a backup creates a tar file consisting of the database as a SQL file and uploaded files from /public/upload/. Having the ability to upload these tar files and restore from them, you can add any fil...

Job Fails with "Retrieved less bytes from the storage [0] than required"

Challenge A Backup or Backup Copy job fails with the error: Retrieved less bytes from the storage 0 than required Symptoms The point may or may not actually be present on the repository when you browse the storage itself. However, the key issue is that the point shows up as 0 B / Incomplete under...

Information Disclosure Via Checkpoint Directory Permission

flink-runtime is vulnerable to information disclosure. The vulnerability can happen because it creates checkpoint directory without specified permission, allowing another user to delete or read files under it. Therefore it can cause restore failure or information disclosure...

No Azure storage accounts can be found

Challenge When attempting to perform a direct restore to Azure through the Veeam Backup & Replication console, or via PowerShell Get-VBRAzureStorageAccount, no storage accounts can be found, or the specified storage account is not returned. Cause The storage accounts specified are blob storage...

Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes

Challenge Veeam Backup for Microsoft 365 1.0 Update 1 Release Notes Cause Note: After installing Update 1, please install the latest update. The package contains two files: Veeam.Backup365.msi and VeeamExplorerForExchange.msi. Prior to installing this update please reboot the Veeam Backup for...

FAQ: Cloud backup of XenMobile managed devices

Is the Worx data encrypted within the backup? If so what is the encryption level? Yes, as Xenmobile uses the iCloud services from Apple for backing up the data: iCloud secures your data by encrypting it when it's sent over the Internet, storing it in an encrypted format when kept on server review...

Restore/SureBackup from old DC restore point fails due to shadow copy expiration

Challenge DC restore results in DSRM boot and event id 1918 from ActiveDirectoryDomainService stating: The shadow copy service cannot restore Active Directory Domain Services because the shadow copy used is too old. Copy Cause The backup of the DC is older than the tombstone period. Active...

XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal

Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory...

XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal

Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory...

WordPress XCloner - Backup and Restore plugin <= 3.1.4 - Authenticated Path Traversal

This plugin is prone to an authenticated path traversal vulnerability. It allows attackers to leverage directory listings to leak otherwise secret file paths to previous backups and acquire full backup contents. Solution Update the plugin to the latest version...

WordPress Backup & Restore Dropbox plugin <= 1.4.7 - Authenticated Information Disclosure Vulnerability

WordPress Restore Dropbox plugin has a PHP object injection vulnerability. The plugin’s admin functions are accessible to any logged in user. Solution Update the plugin...