Veeam

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-26503 1Veeam 1Veeam Jun 17, 2026 Mar 17, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.
CVE-2021-35971 1Veeam 1Veeam Backup & Replication Jun 17, 2026 Jun 30, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
CVE-2020-15419 1Veeam 1One Firmware Jun 17, 2026 Jul 28, 2020 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exi...Show more This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.Show less
CVE-2020-15418 1Veeam 1One Firmware Jun 17, 2026 Jul 28, 2020 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exi...Show more This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.Show less
CVE-2020-15518 1Veeam 2Veeam Availability Suite Veeam Backup & Replication Jun 17, 2026 Jul 3, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
CVE-2020-10915 1Veeam 1One Jun 17, 2026 Apr 22, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within...Show more This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.Show less
CVE-2020-10914 1Veeam 1One Jun 17, 2026 Apr 22, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within...Show more This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10400.Show less
CVE-2019-14298 1Veeam 1One Reporter Jun 17, 2026 Jul 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
CVE-2019-14297 1Veeam 1One Reporter Jun 17, 2026 Jul 27, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
CVE-2019-11569 1Veeam 1One Reporter Jun 17, 2026 May 6, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Veeam ONE Reporter 9.5.0.3201 allows CSRF.
CVE-2015-5742 1Veeam 1Veeam Backup & Replication May 6, 2026 Oct 16, 2015 N/A· v4 N/A· v3 2.1 LOW· v2 VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by readi...Show more VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.Show less

Previous 1 2 34