One
Monthly
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.
Denial of service via out-of-range operator-code lookup in Samsung ONE machine learning framework prior to version 1.30.0 allows local attackers with user interaction to crash the model loading process. Missing bounds validation during operator code indexing permits access to invalid memory locations, triggering application termination without authentication.
Improper validation of STRING tensor offsets in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user interaction to trigger out-of-bounds memory access during constant tensor import, potentially causing information disclosure, data modification, or denial of service. The vulnerability affects the tensor metadata parsing logic when processing malformed string tensor definitions.
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause incorrect buffer sizing for large constant nodes, leading to buffer overflow conditions that may result in information disclosure or denial of service. The vulnerability requires local access and user interaction but can trigger high-severity memory corruption due to incorrect buffer allocation for tensors exceeding integer size limits.
Integer overflow in tensor copy size calculation within Samsung Open Source ONE enables out of bounds memory access during loop state propagation. Unauthenticated local attackers with user interaction can trigger the overflow to read sensitive data, modify memory, or cause denial of service on affected versions prior to 1.30.0. CVSS 6.6 indicates moderate severity with high availability impact.
Integer overflow in scratch buffer initialization within Samsung Open Source ONE allows local attackers with user interaction to cause denial of service and memory corruption affecting large intermediate tensor processing. Versions prior to 1.30.0 are vulnerable. The vulnerability stems from incorrect size calculation during memory allocation for scratch buffers, resulting in undersized allocations that corrupt adjacent memory regions when large tensors are processed.
Integer overflow in memory copy size calculation in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user privileges to trigger invalid memory operations by supplying tensors with large shapes, potentially causing information disclosure, data corruption, or denial of service. The vulnerability requires user interaction (UI:R) and operates with low attack complexity on local systems. No public exploit code or active exploitation has been identified.
Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.
Integer overflow in tensor buffer size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user-level privileges to cause out-of-bounds memory access, leading to information disclosure and denial of service. The vulnerability requires user interaction to process specially crafted large tensor data. CVSS 6.6 indicates moderate severity with local attack vector and high availability impact.
Integer overflow in tensor allocation size calculation within Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause denial of service or memory corruption. The vulnerability arises when processing large tensors, where insufficient memory allocation due to integer wraparound can lead to heap corruption. While CVSS indicates moderate severity (5.3), the high attack complexity and user interaction requirements limit practical exploitation.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Insufficiently Protected Credentials vulnerability could allow attackers to obtain user credentials due to weak protection mechanisms.
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated, high-privileged attacker circumvent the configured 2FA 'Connections approval' control on the Unattended Access feature and establish a full remote session to the target Mac. The flaw is a business-logic error in the connection-approval flow (CWE-288) rather than a memory-safety issue, and successful exploitation yields interactive control of the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.
Denial of service via out-of-range operator-code lookup in Samsung ONE machine learning framework prior to version 1.30.0 allows local attackers with user interaction to crash the model loading process. Missing bounds validation during operator code indexing permits access to invalid memory locations, triggering application termination without authentication.
Improper validation of STRING tensor offsets in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user interaction to trigger out-of-bounds memory access during constant tensor import, potentially causing information disclosure, data modification, or denial of service. The vulnerability affects the tensor metadata parsing logic when processing malformed string tensor definitions.
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause incorrect buffer sizing for large constant nodes, leading to buffer overflow conditions that may result in information disclosure or denial of service. The vulnerability requires local access and user interaction but can trigger high-severity memory corruption due to incorrect buffer allocation for tensors exceeding integer size limits.
Integer overflow in tensor copy size calculation within Samsung Open Source ONE enables out of bounds memory access during loop state propagation. Unauthenticated local attackers with user interaction can trigger the overflow to read sensitive data, modify memory, or cause denial of service on affected versions prior to 1.30.0. CVSS 6.6 indicates moderate severity with high availability impact.
Integer overflow in scratch buffer initialization within Samsung Open Source ONE allows local attackers with user interaction to cause denial of service and memory corruption affecting large intermediate tensor processing. Versions prior to 1.30.0 are vulnerable. The vulnerability stems from incorrect size calculation during memory allocation for scratch buffers, resulting in undersized allocations that corrupt adjacent memory regions when large tensors are processed.
Integer overflow in memory copy size calculation in Samsung Open Source ONE prior to commit 1.30.0 allows local attackers with user privileges to trigger invalid memory operations by supplying tensors with large shapes, potentially causing information disclosure, data corruption, or denial of service. The vulnerability requires user interaction (UI:R) and operates with low attack complexity on local systems. No public exploit code or active exploitation has been identified.
Integer overflow in Samsung Open Source ONE's output tensor copy size calculation allows local attackers with user interaction to cause memory corruption and potential code execution through oversized tensor processing. The vulnerability affects versions prior to 1.30.0 and stems from improper integer arithmetic when computing copy lengths for tensor data, enabling an attacker to trigger buffer overflows by crafting malicious tensor inputs that bypass size validation.
Integer overflow in tensor buffer size calculation in Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user-level privileges to cause out-of-bounds memory access, leading to information disclosure and denial of service. The vulnerability requires user interaction to process specially crafted large tensor data. CVSS 6.6 indicates moderate severity with local attack vector and high availability impact.
Integer overflow in tensor allocation size calculation within Samsung Open Source ONE prior to version 1.30.0 allows local attackers with user interaction to cause denial of service or memory corruption. The vulnerability arises when processing large tensors, where insufficient memory allocation due to integer wraparound can lead to heap corruption. While CVSS indicates moderate severity (5.3), the high attack complexity and user interaction requirements limit practical exploitation.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Insufficiently Protected Credentials vulnerability could allow attackers to obtain user credentials due to weak protection mechanisms.
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.