Veeam Backup and Replication Deserialization Vulnerability

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter

This vulnerability allows a Backup or Tape Operator to write files as root

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

A vulnerability allowing remote code execution (RCE) for domain users

A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information…

An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account

A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA

A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level

A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE)

A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code