Vulnerabilities (CVE)

Filtered by vendor Veeam Subscribe
Total 21 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-41723 1 Veeam 1 One 2024-10-29 N/A 4.3 MEDIUM
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.
CVE-2024-42020 1 Veeam 1 One 2024-10-27 N/A 5.4 MEDIUM
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
CVE-2024-40711 1 Veeam 1 Veeam Backup \& Replication 2024-10-18 N/A 9.8 CRITICAL
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
CVE-2023-27532 1 Veeam 1 Veeam Backup \& Replication 2024-05-09 N/A 7.5 HIGH
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
CVE-2015-5742 1 Veeam 1 Veeam Backup \& Replication 2024-05-09 2.1 LOW N/A
VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.
CVE-2022-26504 1 Veeam 1 Veeam Backup \& Replication 2024-05-09 9.0 HIGH 8.8 HIGH
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
CVE-2022-26501 1 Veeam 1 Veeam Backup \& Replication 2024-05-09 10.0 HIGH 9.8 CRITICAL
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVE-2022-26500 1 Veeam 1 Veeam Backup \& Replication 2024-05-09 6.5 MEDIUM 8.8 HIGH
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
CVE-2024-22021 1 Veeam 3 Availability Orchestrator, Disaster Recovery Orchestrator, Recovery Orchestrator 2024-02-29 N/A 4.3 MEDIUM
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.
CVE-2024-22022 1 Veeam 1 Recovery Orchestrator 2024-02-15 N/A 8.8 HIGH
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
CVE-2022-32225 1 Veeam 1 Management Pack 2024-02-04 N/A 6.1 MEDIUM
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.
CVE-2022-26503 2 Microsoft, Veeam 2 Windows, Veeam 2024-02-04 7.2 HIGH 7.8 HIGH
Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.
CVE-2021-35971 1 Veeam 1 Veeam Backup \& Replication 2024-02-04 7.5 HIGH 9.8 CRITICAL
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
CVE-2020-15518 1 Veeam 2 Veeam Availability Suite, Veeam Backup \& Replication 2024-02-04 6.5 MEDIUM 8.8 HIGH
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
CVE-2020-10914 1 Veeam 1 One 2024-02-04 7.5 HIGH 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10400.
CVE-2020-10915 1 Veeam 1 One 2024-02-04 7.5 HIGH 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.
CVE-2020-15419 1 Veeam 2 One, One Firmware 2024-02-04 7.8 HIGH 7.5 HIGH
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.
CVE-2020-15418 1 Veeam 2 One, One Firmware 2024-02-04 7.8 HIGH 7.5 HIGH
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
CVE-2019-14298 1 Veeam 1 One Reporter 2024-02-04 3.5 LOW 5.4 MEDIUM
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
CVE-2019-14297 1 Veeam 1 One Reporter 2024-02-04 3.5 LOW 5.4 MEDIUM
Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.