CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33672
https://notcve.org/view.php?id=CVE-2024-33672
26 Apr 2024 — An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files. Se descubrió un problema en Veritas NetBackup antes de la versión 10.4. El agente multiproceso utilizado en NetBackup se puede aprovechar para realizar la eliminación arbitraria de archivos protegidos. • https://www.veritas.com/support/en_US/security/VTS24-001 • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2024-28222
https://notcve.org/view.php?id=CVE-2024-28222
07 Mar 2024 — In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file. En Veritas NetBackup anterior a 8.1.2 y NetBackup Appliance anterior a 3.1.2, el proceso BPCD valida inadecuadamente la ruta del archivo, lo que permite que un atacante no autenticado cargue y ejecute un archivo personalizado. • https://www.veritas.com/content/support/en_US/security/VTS23-010 •
CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2023-40256
https://notcve.org/view.php?id=CVE-2023-40256
11 Aug 2023 — A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the confidentiality and integrity of messages controlling the backup and restore jobs, and could result in the service becoming unavailable. This impacts only the jobs controlling the backup and restore activities, and ... • https://www.veritas.com/content/support/en_US/security/VTS23-011 • CWE-295: Improper Certificate Validation •
CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-37237
https://notcve.org/view.php?id=CVE-2023-37237
29 Jun 2023 — In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH. • https://www.veritas.com/content/support/en_US/security/VTS23-004 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26788
https://notcve.org/view.php?id=CVE-2023-26788
10 Apr 2023 — Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. • https://github.com/IthacaLabs/Veritas-Technologies • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26789
https://notcve.org/view.php?id=CVE-2023-26789
05 Apr 2023 — Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser. • https://github.com/IthacaLabs/Veritas-Technologies • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-28818
https://notcve.org/view.php?id=CVE-2023-28818
24 Mar 2023 — An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors. • https://www.veritas.com/content/support/en_US/security/VTS23-002 • CWE-347: Improper Verification of Cryptographic Signature CWE-494: Download of Code Without Integrity Check •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28758
https://notcve.org/view.php?id=CVE-2023-28758
23 Mar 2023 — An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files. • https://www.veritas.com/content/support/en_US/security/VTS23-003 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28759
https://notcve.org/view.php?id=CVE-2023-28759
23 Mar 2023 — An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may allow a lower-level user to elevate privileges and compromise the system. • https://www.veritas.com/content/support/en_US/security/VTS23-006 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46410
https://notcve.org/view.php?id=CVE-2022-46410
04 Dec 2022 — An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate privileges to root by using specific commands. Se descubrió un problema en Veritas NetBackup Flex Scale hasta 3.0. Un atacante con privilegios no root puede escalar privilegios a root mediante el uso de comandos específicos. • https://www.veritas.com/content/support/en_US/security/VTS22-019#issue5 •