Page 2 of 8 results (0.010 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-7284

https://notcve.org/view.php?id=CVE-2017-7284

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover. Un atacante que ha secuestrado un Unitrends Enterprise Backup (en versiones anteriores a 9.1.2) sesión de servidor web puede aprovechar api/includes/users.php para cambiar la contraseña de la cuenta registrada sin conocer la contraseña actual. Esto permite una toma de control de la cuenta. • https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1 • CWE-287: Improper Authentication •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2014-3139 – Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution

https://notcve.org/view.php?id=CVE-2014-3139

recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. recoveryconsole/bpl/snmpd.php en Unitrends Enterprise Backup 7.3.0 permite a atacantes remotos evadir autenticación mediante la configuración del parámetro auth hacia cierta cadena. • https://www.exploit-db.com/exploits/32885 http://seclists.org/fulldisclosure/2014/Apr/204 http://www.exploit-db.com/exploits/32885 https://gist.github.com/brandonprry/10745756 • CWE-287: Improper Authentication •

CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 3

CVE-2014-3008 – Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution

https://notcve.org/view.php?id=CVE-2014-3008

Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. Unitrends Enterprise Backup 7.3.0 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro comm hacia recoveryconsole/bpl/snmpd.php. • https://www.exploit-db.com/exploits/32885 http://seclists.org/fulldisclosure/2014/Apr/204 http://secunia.com/advisories/58001 http://www.exploit-db.com/exploits/32885 http://www.securityfocus.com/bid/66928 https://exchange.xforce.ibmcloud.com/vulnerabilities/92642 https://gist.github.com/brandonprry/10745756 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •