CVE-2024-42012

GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user's decrypted cleartext password. An attacker with Windows admin or debugging rights can therefore steal the user's Blocky password and from there impersonate that local user.

• CWE-522

• https://www.blockyforveeam.com/en/security-bulletin-2024-06-25/
• https://www.graudata.com/en/products/protection-against-ransomware/blocky-for-veeam/

Published

Jan 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42007SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory…5.8
• CVE-2024-42008A Cross-Site Scripting vulnerability in rcmail_action_mail_g…9.3
• CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.…9.3
• CVE-2024-4201A cross-site scripting issue has been discovered in GitLab a…4.4
• CVE-2024-42010mod_css_styles in Roundcube through 1.5.7 and 1.6.x through …7.5
• CVE-2024-42011The Spotify app 8.9.58 for iOS has a buffer overflow in its …7.5
• CVE-2024-42013In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side…6.4
• CVE-2024-42017An issue was discovered in Atos Eviden iCare 2.7.1 through 2…10
• CVE-2024-42018An issue was discovered in Atos Eviden SMC xScale before 1.6…7.7
• CVE-2024-42019A vulnerability that allows an attacker to access the NTLM h…8
• CVE-2024-4202In Progress® Telerik® Reporting versions prior to 2024 Q2 (1…8.6
• CVE-2024-42020A Cross-site-scripting (XSS) vulnerability exists in the Rep…5.4