CVE-2024-3781

CVE-2024-3781 affects WBSAirback 21.02.04 with a command-injection vulnerability caused by improper neutralisation of special elements in Active Directory integration, allowing an attacker to modify the intended command sent to a downstream component. Connected sources confirm the impact is on WB...

CVE-2024-3784

CVE-2024-3784 affects WBSAirback 21.02.04. The vulnerability is due to improper neutralisation of Server-Side Includes (SSI) through the S3 Accounts API at /admin/CloudAccounts, which could allow a remote attacker to execute arbitrary code. Public documents describe the issue and impact but do no...

CVE-2024-3786

WBSAirback 21.02.04 is affected by an SSI (Server-Side Includes) handling flaw exposed via the Device Synchronizations API at /admin/DeviceReplication. The root cause is improper neutralization, enabling a remote attacker to execute arbitrary code. Several sources corroborate this CVE-2024-3786 v...

CVE-2024-3782

CVE-2024-3782 is a CSRF vulnerability in WBSAirback 21.02.04. The issue arises from an attacker creating a manipulated HTML form to trigger privileged actions when executed by a privileged user. The CVSS v3.1 vector indicates no user privileges required, network attack vector, and required user i...

CVE-2024-3783

WBSAirback 21.02.04 Backup Agents contains a path traversal vulnerability that a low-privilege user can exploit to download files from the system. Affected component: path handling in WBSAirback; impact is confidentiality breach. No remediation details are provided in the supplied documents.

CVE-2024-3785

WBSAirback 21.02.04 is affected by a vulnerability described as improper neutralisation of Server-Side Includes (SSI) via the Device NAS shared section (/admin/DeviceNAS). The root cause is SSI handling in the Device NAS path, which could allow a remote attacker to execute arbitrary code. Affecte...

CVE-2024-3787

The CVE-2024-3787 vulnerability affects WBSAirback 21.02.04 and is due to improper neutralisation of Server-Side Includes (SSI) via the /admin/DeviceS3 endpoint. The issue could allow a remote attacker to execute arbitrary code, potentially enabling privilege escalation. Affected component: WBSAi...

CVE-2024-3792

WBSAirback 21.02.04 is affected by a stored XSS via the /admin/DeviceReplication endpoint (execution range field; all parameters). A remote attacker could craft a URL to steal session data. PT-2024-27825 confirms the issue and recommends temporarily disabling the /admin/DeviceReplication endpoint...

CVE-2024-3790

Summary : CVE-2024-3790 affects WBSAirback 21.02.04 via a stored XSS flaw exposed at the /admin/SystemUsers endpoint, specifically in the login, description fields, and the passwd1/passwd2 parameters. The vulnerability could allow a remote attacker to deliver a crafted URL that steals session dat...

CVE-2024-3795

WBSAirback 21.02.04 is affected by a stored XSS vulnerability in the /admin/BackupTemplate endpoint, specifically in the name and description fields. The vulnerability could let an attacker craft a URL to execute script in a victim’s browser and potentially steal session data. Affected software/c...

CVE-2024-3794

CVE-2024-3794 affects WBSAirback 21.02.04 with a stored XSS vulnerability in the /admin/AdvancedSystem endpoint (description field, all parameters). The issue could allow a remote attacker to craft a URL to steal session data. No patch/version details are provided in the documents; a PT-2024-2784...

CVE-2024-3796

CVE-2024-3796 affects WBSAirback 21.02.04 with a stored XSS in the /admin/BackupSchedule endpoint (description field). A remote attacker could send a crafted URL to steal session data. Exploitation details are not confirmed in all sources, but PT-2024-27865 recommends disabling access to the /adm...

CVE-2024-3791

WBSAirback (version 21.02.04) contains a stored XSS in /admin/SystemConfiguration, affecting the name, free memory limit fields, and type/password parameters. Exploitation could allow a remote attacker to craft a URL that steals session data. The PT-2024-27822 entry provides concrete details of t...

CVE-2024-3788

WBSAirback 21.02.04 is affected by an improper neutralization of Server-Side Includes (SSI) via the License endpoint (/admin/CDPUsers). A remote attacker could execute arbitrary code. The PT-Security advisory for PT-2024-27806 confirms the endpoint-based SSI handling issue and notes that, as of t...

CVE-2024-3789

CVE-2024-3789 affects White Bear Solutions WBSAirback, version 21.02.04. The advisory describes an uncontrolled resource consumption vulnerability that could let an attacker send multiple command injection payloads to influence resource usage. Exploitation details are not provided beyond that pay...

CVE-2024-3793

WBSAirback 21.02.04 is affected by a stored XSS via the /admin/CloudAccounts endpoint, impacting fields such as account name, user password, and server in multiple parameters. An attacker could deliver a crafted URL to harvest session data. Remediation guidance from PT Security suggests disabling...