Backblaze
Monthly
Improper link resolution in the Backblaze Client for Windows allows a local user to render a system unbootable by creating a junction or symbolic link from Backblaze's backup folder to critical Windows OS system files, which the backup process then processes without adequate validation. The vulnerability is scoped to Windows deployments where specific OS-level security controls have been disabled through an administrator-level change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Rated medium severity (CVSS 4.7).
b2-sdk-python is a python library to access cloud storage provided by backblaze. Rated medium severity (CVSS 4.7).
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper link resolution in the Backblaze Client for Windows allows a local user to render a system unbootable by creating a junction or symbolic link from Backblaze's backup folder to critical Windows OS system files, which the backup process then processes without adequate validation. The vulnerability is scoped to Windows deployments where specific OS-level security controls have been disabled through an administrator-level change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Rated medium severity (CVSS 4.7).
b2-sdk-python is a python library to access cloud storage provided by backblaze. Rated medium severity (CVSS 4.7).
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.