CVE-2017-17425

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSourceDeviceSet Get method requests. The issue...

CVE-2017-17654

CVE-2017-17654 affects Quest NetVault Backup 11.3.0.12. The flaw is an SQL injection in the NVBUBackup ClientList method where unsanitized user input is used to build SQL queries, enabling remote code execution in the database context without authentication. Documented by ZDI-4287 and mirrored in...

CVE-2017-17417

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. The issue...

CVE-2017-17658

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue...

CVE-2017-17655

The CVE concerns Quest NetVault Backup (11.3.0.12). The vulnerability is a SQL injection in the NVBUBackup PluginList request handling, caused by improper validation of a user-supplied string used to construct SQL queries. This enables remote code execution in the context of the underlying databa...

CVE-2017-17416

CVE-2017-17416 affects Quest NetVault Backup (v11.3.0.12) with a SQL injection in NVBUPhaseStatus GetPlugins handling that allows remote code execution in the database context. The flaw results from insufficient validation of a user-supplied string used to build SQL queries, and authentication is...

CVE-2017-17412

The CVE-2017-17412 issue affects Quest NetVault Backup (version 11.3.0.12). It is an SQL injection in the NVBUEventHistory Get method/JSON-RPC Get path caused by improper validation of user-supplied input used to construct SQL queries, enabling remote code execution in the database context. Explo...

CVE-2017-17655

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup PluginList method requests. The issue resul...

CVE-2017-17422

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Get method requests. The issue results from...

CVE-2017-17654

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup ClientList method requests. The issue resul...

CVE-2017-17415

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Count method requests. The issue resul...

CVE-2017-17652

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Count method requests. The issue results fr...

CVE-2018-1161

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart reques...

CVE-2017-17658

CVE-2017-17658 affects Quest NetVault Backup 11.3.0.12. The vulnerability is a SQL injection in the NVBUJobDefinitions Get method, caused by insufficient validation of a user-supplied string before constructing SQL queries. Exploitation does not require authentication, allowing remote attackers t...

CVE-2017-17424

CVE-2017-17424 affects Quest NetVault Backup, specifically vulnerable in the NVBUScheduleSet Get method handling. The issue is a SQL injection due to improper validation of a user-supplied string used to construct SQL queries, allowing remote attackers to execute arbitrary code in the context of ...

CVE-2017-17656

CVE-2017-17656 affects Quest NetVault Backup (v11.3.0.12). The vulnerability is SQL injection in the NVBUBackup JobList handling, arising from insufficient validation of a user-supplied string before building SQL queries, enabling remote code execution in the database context. Authentication is n...

CVE-2017-17418

CVE-2017-17418 affects Quest NetVault Backup 11.3.0.12. The vulnerability arises from improper validation of a user-supplied string in NVBUPolicy Get method, leading to SQL injection and the potential to execute code in the underlying database context. Authentication is not required. Multiple con...

CVE-2017-17423

CVE-2017-17423 affects Quest NetVault Backup 11.3.0.12 and earlier. The flaw is an SQL injection in NVBUBackupSegment Get method handling, caused by insufficient validation of a user-supplied string used in SQL queries, allowing remote code execution in the database context. Public advisories con...

CVE-2017-17415

CVE-2017-17415 affects Quest NetVault Backup 11.3.0.12. A SQL injection in the NVBUPhaseStatus Count method arises from insufficient validation of a user-supplied string used to build SQL queries, allowing remote attackers to execute arbitrary code in the database context without authentication. ...

CVE-2017-17657

CVE-2017-17657 affects Quest NetVault Backup, where NVBUBackup TimeRange method requests are mishandled due to insufficient validation of a user-supplied string used in SQL queries. This enables remote code execution with the database context and does not require authentication. Documented in mul...