CVE-2017-7284: Improper Authentication

An attacker that has hijacked a Unitrends Enterprise Backup before 9.1.2 web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover...

PT-2017-17635

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup versions prior to 9.1.2 Description The issue allows an attacker who has hijacked a Unitrends Enterprise Backup web server session to change the password of the logged-in account without knowing the current password...