CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-36956
https://notcve.org/view.php?id=CVE-2022-36956
27 Jul 2022 — In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1. En Veritas NetBackup, el Cliente NetBackup permite una ejecución de comandos arbitrarios desde cualquier host remoto que tenga acceso a un certificado/clave privada de NetBackup con un ID de host válido del mismo dominio. Afecta a versiones 9.0.x hasta 9.0.0.1 ... • https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue1 •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41570
https://notcve.org/view.php?id=CVE-2021-41570
19 Apr 2022 — Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation. Veritas NetBackup OpsCenter Analytics versión 9.1, permite un uso de tipo XSS por medio de los campos NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password durante una operación de Añadir Ajustes/Configuración • https://www.veritas.com/content/support/en_US/security/VTS22-007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 94%CPEs: 97EXPL: 82CVE-2022-22965 – Spring Framework JDK 9+ Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-22965
01 Apr 2022 — A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Una aplicación Spring MVC o Spring WebFlux que es ejecutada en JDK 9+ puede ser ... • https://packetstorm.news/files/id/167011 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 0%CPEs: 14EXPL: 0CVE-2020-36162
https://notcve.org/view.php?id=CVE-2020-36162
06 Jan 2021 — An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix. The CloudPoint Windows Agent leverages OpenSSL. This OpenSSL library attempts to load the \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems users can create directories under <drive>:\. A low privileged user can create a <drive>:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, which may result in arbitrary code execution. • https://www.veritas.com/content/support/en_US/security/VTS20-011 •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-36163
https://notcve.org/view.php?id=CVE-2020-36163
06 Jan 2021 — An issue was discovered in Veritas NetBackup and OpsCenter through 8.3.0.1. NetBackup processes using Strawberry Perl attempt to load and execute libraries from paths that do not exist by default on the Windows operating system. By default, on Windows systems, users can create directories under C:\. If a low privileged user on the Windows system creates an affected path with a library that NetBackup attempts to load, they can execute arbitrary code as SYSTEM or Administrator. This gives the attacker adminis... • https://www.veritas.com/content/support/en_US/security/VTS20-016#Issue2 •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-36169
https://notcve.org/view.php?id=CVE-2020-36169
06 Jan 2021 — An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. Processes using OpenSSL attempt to load and execute libraries from paths that do not exist by default on the Windows operating system. By default, on Windows systems, users can create directories under the top level of any drive. If a low privileged user creates an affected path with a library that the Veritas product attempts to load, they can execute arbitrary code as SYSTEM or Administrator. This gives the attacke... • https://www.veritas.com/content/support/en_US/security/VTS20-016#Issue1 •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9868
https://notcve.org/view.php?id=CVE-2019-9868
19 Mar 2019 — An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator. Se ha descubierto un problema en Web Console en Veritas NetBackup Appliance hasta la versión 3.1.2. La contraseña SMTP se muestra a un administrador. • http://www.securityfocus.com/bid/107567 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9867
https://notcve.org/view.php?id=CVE-2019-9867
19 Mar 2019 — An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator. Se ha descubierto un problema en Web Console en Veritas NetBackup Appliance hasta la versión 3.1.2. La contraseña del servidor proxy se muestra a un administrador. • http://www.securityfocus.com/bid/107567 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2018-18652
https://notcve.org/view.php?id=CVE-2018-18652
25 Oct 2018 — A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input. Una vulnerabilidad de ejecución remota de comandos en Veritas NetBackup Appliance en versiones anteriores a la 3.1.2 permite que administradores autenticados ejecuten comandos arbitrarios como root. El problema viene provocado por el filtrado insuficiente de entradas proporcionad... • http://www.securityfocus.com/bid/105737 •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2017-8856
https://notcve.org/view.php?id=CVE-2017-8856
09 May 2017 — In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' process. En Veritas NetBackup 8.0 y versiones anteriores y NetBackup Appliance 3.0 y versiones anteriores, hay una ejecución de comandos remotos arbitrarios no autenticados utilizando el proceso 'bprd'. • http://www.securityfocus.com/bid/98379 • CWE-732: Incorrect Permission Assignment for Critical Resource •