CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26788
https://notcve.org/view.php?id=CVE-2023-26788
Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. • https://github.com/IthacaLabs/Veritas-Technologies https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20Appliance%20v4.1.0.1/HHI/HHI_CVE-2023-26788.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26789
https://notcve.org/view.php?id=CVE-2023-26789
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser. • https://github.com/IthacaLabs/Veritas-Technologies https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20NetBackUp%20OpsCenter%20Version%209.1.0.1/Reflected%20XSS/XSS.txt https://github.com/IthacaLabs/Veritas-Technologies/blob/main/Veritas%20NetBackUp%20OpsCenter%20Version%209.1.0.1/Reflected%20XSS/XSS_CVE-2023-26789.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-28818
https://notcve.org/view.php?id=CVE-2023-28818
An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors. • https://www.veritas.com/content/support/en_US/security/VTS23-002 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28758
https://notcve.org/view.php?id=CVE-2023-28758
An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files. • https://www.veritas.com/content/support/en_US/security/VTS23-003 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28759
https://notcve.org/view.php?id=CVE-2023-28759
An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may allow a lower-level user to elevate privileges and compromise the system. • https://www.veritas.com/content/support/en_US/security/VTS23-006 • CWE-427: Uncontrolled Search Path Element •