Read the docs

Veeam

Records120All Threatist records
Exploited (KEV)4In CISA KEV
CVSS critical34CVSS 9.0–10.0
CVSS high57CVSS 7.0–8.9

Exploited now

Veeam records in CISA KEV
TI-2024-27107 Veeam Backup and Replication Deserialization Vulnerability Priority CRITICAL 100KEV 2024-10-17TI-2023-12256 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Priority CRITICAL 90KEV 2023-08-22TI-2022-09843 Veeam Backup & Replication Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2022-12-13TI-2022-09844 Veeam Backup & Replication Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-12-13

Components

Products in the NVD configurations · select one to filter the records
Veeam Backup & Replication 42 records CRITICAL One 12 records HIGH One Reporter 3 records MEDIUM Recovery Orchestrator 3 records MEDIUM Veeam Agent For Windows 3 records LOW One Firmware 2 records HIGH Veeam Service Provider Console 2 records MEDIUM Availability Orchestrator 1 record LOW

Records

12 records in One · all components

TI-2020-08796 CVE-2020-10915 · GHSA-8h5c-9h59-x8hw

Deserialization of untrusted data in Veeam One Agent

Priority HIGH 84

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.86734 Published 2020-04-22 No fix listed CWE-502
TI-2020-08795 CVE-2020-10914 · GHSA-jqjc-5vjm-rwq5

Deserialization of untrusted data in Veeam One Agent

Priority HIGH 72

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47868 Published 2020-04-22 No fix listed CWE-502
TI-2023-19924 CVE-2023-38547 · GHSA-f346-p877-7wqq

Information disclosure in Veeam One

Priority MEDIUM 62

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.2067 Published 2023-11-07 No fix listed CWE-200
TI-2023-19926 CVE-2023-38549 · GHSA-5xw6-9h38-rh99

Cross-site scripting in Veeam One

Priority MEDIUM 43

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.19129 Published 2023-11-07 No fix listed CWE-79
TI-2023-19925 CVE-2023-38548 · GHSA-5v7j-rmqq-795g

Insufficiently protected credentials in Veeam One

Priority MEDIUM 42

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.11659 Published 2023-11-07 No fix listed CWE-522
TI-2024-28036 CVE-2024-42023 · GHSA-4rmw-g454-gq8g

Improper access control in Veeam One

Priority MEDIUM 40

An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0047 Published 2024-09-07 No fix listed CWE-284
TI-2024-28032 CVE-2024-42019 · GHSA-3683-hgvx-mjx6

Information disclosure in Veeam One

Priority LOW 38

A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00544 Published 2024-09-07 No fix listed CWE-200
TI-2023-22138 CVE-2023-41723 · GHSA-2jf9-9rxc-j63c

Insecure storage of sensitive information in Veeam One

Priority LOW 34

A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.12513 Published 2023-11-07 No fix listed CWE-922
Open these records in search →