CVE-2021-43038

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user...

Privilege escalation

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user...

Design/Logic Flaw

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due to insecure default permissions. This allowed privilege escalation from an unprivileged user to SYSTEM...

Privilege escalation

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation...

Unitrends Backup SQL注入漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A SQL injection vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

CVE-2021-43039

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access...

CVE-2021-43043

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

PT-2021-23733 · Kaseya · Kaseya Unitrends Backup Appliance

Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered in the SNMP daemon, which was configured with a weak default community. Recommendations: For versions prior to 10.5.5, update to version 10.5.5 or...

PT-2021-23724 · Kaseya · Kaseya Unitrends Backup Appliance

Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered in the software, involving two unauthenticated SQL injection vulnerabilities. These vulnerabilities allow arbitrary SQL queries to be injected and...

CVE-2021-43038

Summary: CVE-2021-43038 affects Kaseya Unitrends Backup Appliance prior to 10.5.5. The issue allows the wguest user to inject commands into PostgreSQL trigger functions, enabling privilege escalation to the postgres user. Affected product/versions: Kaseya Unitrends Backup Appliance before 10.5.5....

CVE-2021-43035

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full acces...

CVE-2021-43043

CVE-2021-43043 affects Kaseya Unitrends Backup Appliance (pre-10.5.5). The issue is an insecure sudo rule that allows the apache user to read arbitrary files (for example /etc/shadow), leading to a local file disclosure vulnerability. Root cause: misconfigured sudo privileges enabling read access...

CVE-2021-43036

The CVE-2021-43036 issue affects Kaseya Unitrends Backup Appliance prior to 10.5.5, where the PostgreSQL wguest account uses a weak password. This is documented in multiple sources; the core detail is the weak wguest password in the affected appliance. Impact is described as a privileged access r...

CVE-2021-43037

CVE-2021-43037 affects Kaseya Unitrends Backup Appliance prior to 10.5.5. The issue is in the Unitrends Windows agent, which is vulnerable to DLL injection and binary planting due to insecure default permissions, enabling privilege escalation from an unprivileged user to SYSTEM . Affected compone...

Unitrends Backup 信任管理问题漏洞

Unitrends Backup is eliminating data loss, ransomware, and risk. versions prior to Unitrends Backup 10.5.5 have an SNMP weak password vulnerability that stems from the SNMP daemon being configured with a weak silent group name, which can be exploited by an attacker to gain snmp control privileges...

Unitrends Backup 格式化字符串错误漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A format string error vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which stems from the creation of an HTTP request that could trigger a format string vulnerability in a privileged vaultServer...

Unitrends Backup 安全漏洞

Unitrends Backup UB is a suite of data protection software from Unitrends, Inc. that provides data backup, data recovery and deduplication functions.A security vulnerability exists in the Kaseya Unitrends Backup Appliance, which could be exploited by an attacker to log into the target system...

Unitrends Backup 安全漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An elevation of privilege vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which originates from the creation of arbitrary writable files on a privileged vault server, and can be exploited by an attacke...

Unitrends Backup 注入漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An injection vulnerability exists in Unitrends Backup versions prior to 10.5.5, which can be exploited by an attacker to escalate a wguest user to a postgres user by injecting a command into a PostgreSQL trigger function in...

PT-2021-23722 · Kaseya · Kaseya Unitrends Backup Appliance

Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered in the Kaseya Unitrends Backup Appliance, where multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as...