The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.
Veeam · Management Pack for Microsoft System Center
The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.
Veeam · Management Pack for Microsoft System Center
The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.
Veeam · Management Pack for Microsoft System Center
WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.
LabRedesCefetRJ · WeGIA
CoPilot before 0.1.76 renders case-report templates with a non-sandboxed Jinja2 engine. A user with the lowest-privilege customer_user role can upload a manipulated template, and it is executed as Python code when an admin or analyst generates a report. In the reported deployment this allowed command execution as root, exposing data of all tenants and stored connector credentials. The PDF renderer additionally allowed local file reads and requests to internal services.
SOCFortress · CoPilot
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.
docat-org · docat
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
HashiCorp · Boundary
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
