CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7279
https://notcve.org/view.php?id=CVE-2017-7279
An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. Un usuario no privilegiado del Unitrends Enterprise Backup en versiones anteriores a 9.0.0 servidor de web puede escalar privilegios root modificando la cookie "token" emitida al iniciar sesión. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2014-3139 – Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-3139
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. recoveryconsole/bpl/snmpd.php en Unitrends Enterprise Backup 7.3.0 permite a atacantes remotos evadir autenticación mediante la configuración del parámetro auth hacia cierta cadena. • https://www.exploit-db.com/exploits/32885 http://seclists.org/fulldisclosure/2014/Apr/204 http://www.exploit-db.com/exploits/32885 https://gist.github.com/brandonprry/10745756 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 3CVE-2014-3008 – Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-3008
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. Unitrends Enterprise Backup 7.3.0 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro comm hacia recoveryconsole/bpl/snmpd.php. • https://www.exploit-db.com/exploits/32885 http://seclists.org/fulldisclosure/2014/Apr/204 http://secunia.com/advisories/58001 http://www.exploit-db.com/exploits/32885 http://www.securityfocus.com/bid/66928 https://exchange.xforce.ibmcloud.com/vulnerabilities/92642 https://gist.github.com/brandonprry/10745756 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •