VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.
5.8AI Score
0.0004EPSS
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
8.8CVSS
8.7AI Score
0.001EPSS
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
9.8CVSS
9.4AI Score
0.007EPSS
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
8.8CVSS
9AI Score
0.001EPSS
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
9.8CVSS
6.8AI Score
0.0004EPSS
8.8CVSS
6.8AI Score
0.0004EPSS
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
7.2CVSS
9.2AI Score
0.0004EPSS
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
2.7CVSS
6.6AI Score
0.0004EPSS
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.
7.8CVSS
6.9AI Score
0.0004EPSS
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role with...
8.8CVSS
7.7AI Score
0.0004EPSS
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
9.8CVSS
8.1AI Score
0.0004EPSS
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).
7.8CVSS
7AI Score
0.0004EPSS
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
7.8CVSS
6.9AI Score
0.0004EPSS
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
8.3CVSS
6.7AI Score
0.0004EPSS