A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server throug…

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 bac…

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configura…

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server throug…

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

A vulnerability allowing remote unauthenticated code execution on the agent host.

A vulnerability allowing local privilege escalation to the Reporter service context.

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing a low-privileged user to extract saved SSH credentials.