CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40710
https://notcve.org/view.php?id=CVE-2024-40710
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication. • https://www.veeam.com/kb4649 • CWE-522: Insufficiently Protected Credentials •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39718
https://notcve.org/view.php?id=CVE-2024-39718
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. • https://www.veeam.com/kb4649 •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-42019
https://notcve.org/view.php?id=CVE-2024-42019
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication. • https://www.veeam.com/kb4649 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2024-29855 – Veeam Recovery Orchestrator Authentication Bypass
https://notcve.org/view.php?id=CVE-2024-29855
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator El secreto JWT codificado permite omitir la autenticación en Veeam Recovery Orchestrator • https://github.com/sinsinology/CVE-2024-29855 https://www.veeam.com/kb4585 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29853
https://notcve.org/view.php?id=CVE-2024-29853
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Una vulnerabilidad de omisión de autenticación en Veeam Agent para Microsoft Windows permite la escalada de privilegios locales. • https://veeam.com/kb4582 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •