Skip to content
OpenAdvisories

Vendor

Veeam

107 known vulnerabilities.

Products

One 21 Backup and Replication 21 Backup and Recovery 14 Backup & Replication 12 Service Provider Console 10 Veeam Service Provider Console 4 Agent for Windows 4 Backup for Microsoft 365 4 Management Pack for Microsoft System Center 3 Recovery Orchestrator 3 Backup for Microsoft Azure 2 Software Appliance 2 One Agent 2 Availability Orchestrator 2 Backup Enterprise Manager 1 Backup for AWS 1 Backup for Google Cloud 1 Backup for Nutanix AHV 1 Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization 1 Backup for Salesforce 1 Nutanix AHV 1 Nutanix KVM 1 Enterprise Manager 1 Backup for Microsoft Windows 1 Agent for Microsoft Windows 1 Disaster Recovery Orchestrator 1 Agent for Linux 1 Backup 0 Management Pack for System Center 0 agent 0 Backup & Replication < 11.0.1.1261 P20220302. 0 veeam_backup_\&_replication 0 ONE < 12.0.1.2591 0 ONE < 11.0.1.1880 0 ONE < 11.0.0.1379 0 Backup & Replication for Google Cloud 1.0 0 Backup & Replication for Google Cloud 3.0 0
All Critical High Medium Low Exploited only Public exploit

107 results · Feed

  • High 8.8
    CVE-2024-40718

    A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through …

    Veeam Nutanix AHV Nutanix KVM Virtualization
  • High 7.8
    CVE-2024-40712

    A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perfo…

    Veeam Backup and Recovery
  • High 8.3
    CVE-2024-40714

    An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network t…

    Veeam Backup and Recovery
  • Critical 9.8
    CVE-2024-40711 Exploited · Ransomware Public exploit Scanner template EPSS 90%

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…

    Veeam Backup and Recovery
    KEV Oct 17, 2024
  • High 7.3
    CVE-2024-42020

    A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.

    Veeam One
  • High 7.5
    CVE-2024-42021

    An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.

    Veeam One
  • Critical 9.1
    CVE-2024-42024

    A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…

    Veeam One
  • High 7.5
    CVE-2024-42022

    An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.

    Veeam One
  • Critical 9.0
    CVE-2024-42019

    A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…

    Veeam One
  • High 7.8
    CVE-2024-42023

    An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remo…

    Veeam One
  • Critical 9.0
    CVE-2024-29855 Public exploit EPSS 22%

    Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

    Veeam Recovery Orchestrator
  • Low 2.7
    CVE-2024-29852

    Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.

    Veeam Backup & Replication
  • High 8.8
    CVE-2024-29850

    Veeam Backup Enterprise Manager allows account takeover via NTLM relay.

    Veeam Backup & Replication
  • High 7.2
    CVE-2024-29851

    Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.

    Veeam Backup & Replication
  • Critical 9.8
    CVE-2024-29849 Public exploit EPSS 39%

    Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

    Veeam Backup & Replication
  • High 7.8
    CVE-2024-29853

    An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.

    Veeam Agent for Windows Windows
  • Critical 9.9
    CVE-2024-29212

    Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe…

    Veeam Service Provider Console
  • High 8.8
    CVE-2024-22022

    Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to …

    Veeam Recovery Orchestrator Availability Orchestrator
  • Medium 6.5
    CVE-2024-22021

    Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retr…

    Veeam Recovery Orchestrator Availability Orchestrator Disaster Recovery Orchestrator
  • Medium 4.5
    CVE-2023-38549 EPSS 19%

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acqu…

    Veeam One
  • Critical 9.8
    CVE-2023-38548 EPSS 12%

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acqu…

    Veeam One
  • Critical 9.9
    CVE-2023-38547 EPSS 21%

    A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam O…

    Veeam One
  • Medium 4.3
    CVE-2023-41723 EPSS 13%

    A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note:…

    Veeam One
  • High 7.5
    CVE-2020-15419 EPSS 60%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

    Veeam One
  • High 7.5
    CVE-2020-15418

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.…

    Veeam One
  • Critical 9.8
    CVE-2020-10915 Public exploit EPSS 88%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…

    Veeam One Agent
  • Critical 9.8
    CVE-2020-10914 Public exploit EPSS 48%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…

    Veeam One Agent