CVE-2017-17425

This CVE affects Quest NetVault Backup. The vulnerability lies in NVBUSourceDeviceSet Get method handling, where unvalidated user input is used to build SQL queries, enabling remote code execution. Affects NetVault Backup versions 11.3.0.12 and, per CNVD, prior to 11.4.5; authentication is not re...

CVE-2017-17654

CVE-2017-17654 affects Quest NetVault Backup 11.3.0.12. The flaw is an SQL injection in the NVBUBackup ClientList method where unsanitized user input is used to build SQL queries, enabling remote code execution in the database context without authentication. Documented by ZDI-4287 and mirrored in...

CVE-2017-17415

CVE-2017-17415 affects Quest NetVault Backup 11.3.0.12. A SQL injection in the NVBUPhaseStatus Count method arises from insufficient validation of a user-supplied string used to build SQL queries, allowing remote attackers to execute arbitrary code in the database context without authentication. ...

CVE-2017-17420

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobCountHistory Get method requests. The issue...

CVE-2018-1162

Summary: CVE-2018-1162 describes a denial-of-service vulnerability in Quest NetVault Backup 11.2.0.13 due to a path validation flaw. The flaw occurs in the handling of Export requests where a user-supplied path isn’t properly validated before file operations, allowing an attacker to arbitrarily o...

CVE-2018-1163

CVE-2018-1163 affects Quest NetVault Backup 11.2.0.13. The vulnerability is a checksession authentication bypass in the web interface’s JSON RPC handling, allowing an unauthenticated attacker to bypass authentication and access critical functions. The description notes this could be combined with...

CVE-2017-17656

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup JobList method requests. The issue results...

CVE-2017-17421

CVE-2017-17421 affects Quest NetVault Backup (notably 11.3.0.12); a SQL injection in NVBUSelectionSet Get requests allows remote code execution with no authentication. Root cause: improper validation of a user-supplied string used to build SQL queries. Documents indicate potential exploit paths a...

CVE-2017-17653

This CVE (CVE-2017-17653) affects Quest NetVault Backup 11.3.0.12. The vulnerability is a SQL injection in NVBUBackupOptionSet Get method requests due to improper validation of a user-supplied string used to build SQL queries, enabling remote code execution in the context of the underlying databa...

CVE-2017-17419

Quest NetVault Backup 11.3.0.12 is affected by a remote SQL injection in NVBUTransferHistory Get requests due to improper validation of a user-supplied string used to build SQL queries. This can allow an attacker to execute arbitrary code in the context of the underlying database without authenti...

CVE-2017-17418

CVE-2017-17418 affects Quest NetVault Backup 11.3.0.12. The vulnerability arises from improper validation of a user-supplied string in NVBUPolicy Get method, leading to SQL injection and the potential to execute code in the underlying database context. Authentication is not required. Multiple con...

CVE-2017-17656

CVE-2017-17656 affects Quest NetVault Backup (v11.3.0.12). The vulnerability is SQL injection in the NVBUBackup JobList handling, arising from insufficient validation of a user-supplied string before building SQL queries, enabling remote code execution in the database context. Authentication is n...

CVE-2017-17655

The CVE concerns Quest NetVault Backup (11.3.0.12). The vulnerability is a SQL injection in the NVBUBackup PluginList request handling, caused by improper validation of a user-supplied string used to construct SQL queries. This enables remote code execution in the context of the underlying databa...

CVE-2017-17417

Quest NetVault Backup Server (Quest NetVault Backup) is affected by CVE-2017-17417 due to an SQL Injection in the Process Manager Service NVBUPhaseStatus Acknowledge handling. Affects versions prior to 11.4.5 (e.g., 11.3.0.12 referenced in sources). The vulnerability allows unauthenticated remote...

CVE-2017-17422

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Get method requests. The issue results from...

CVE-2017-17425

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSourceDeviceSet Get method requests. The issue...

CVE-2017-17423

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupSegment Get method requests. The issue resul...

CVE-2017-17412

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET method requests. The issue results from the lack o...

CVE-2017-17419

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue...

CVE-2017-17420

CVE-2017-17420 affects Quest NetVault Backup (Server Process Manager Service) via an SQL injection in NVBUJobCountHistory Get method. The root cause is improper validation of user-supplied input used to construct SQL queries, enabling unauthenticated remote code execution in the database context....