Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup ClientList method requests. The issue resul...

CVE-2017-17652

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Count method requests. The issue results fr...

CVE-2017-17425

This CVE affects Quest NetVault Backup. The vulnerability lies in NVBUSourceDeviceSet Get method handling, where unvalidated user input is used to build SQL queries, enabling remote code execution. Affects NetVault Backup versions 11.3.0.12 and, per CNVD, prior to 11.4.5; authentication is not re...

CVE-2017-17654

CVE-2017-17654 affects Quest NetVault Backup 11.3.0.12. The flaw is an SQL injection in the NVBUBackup ClientList method where unsanitized user input is used to build SQL queries, enabling remote code execution in the database context without authentication. Documented by ZDI-4287 and mirrored in...

CVE-2017-17415

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Count method requests. The issue resul...

CVE-2017-17655

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup PluginList method requests. The issue resul...

CVE-2017-17652

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Count method requests. The issue results fr...

CVE-2017-17652

CVE-2017-17652 affects Quest NetVault Backup, specifically the Server Process Manager Service’s NVBUBackup Count method. The root cause is improper validation of user-supplied input used to build SQL queries, enabling an SQL injection that can lead to remote code execution in the database context...

CVE-2018-1161

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart reques...

CVE-2017-17423

CVE-2017-17423 affects Quest NetVault Backup 11.3.0.12 and earlier. The flaw is an SQL injection in NVBUBackupSegment Get method handling, caused by insufficient validation of a user-supplied string used in SQL queries, allowing remote code execution in the database context. Public advisories con...

CVE-2017-17659

The CVE-2017-17659 issue affects Quest NetVault Backup, specifically NVBUJobHistory Get method handling. The root cause is improper validation of user-supplied strings used in SQL queries, enabling remote code execution in the database context. Public sources confirm vulnerable versions include 1...

CVE-2017-17422

CVE-2017-17422 affects Quest NetVault Backup before 11.4.5 (specifically 11.3.0.12 in the initial data) and is triggered via the NVBUBackup Get method. The root cause is insufficient validation of a user-supplied string used to construct SQL queries, enabling remote code execution in the context ...

CVE-2017-17415

CVE-2017-17415 affects Quest NetVault Backup 11.3.0.12. A SQL injection in the NVBUPhaseStatus Count method arises from insufficient validation of a user-supplied string used to build SQL queries, allowing remote attackers to execute arbitrary code in the database context without authentication. ...

CVE-2017-17418

CVE-2017-17418 affects Quest NetVault Backup 11.3.0.12. The vulnerability arises from improper validation of a user-supplied string in NVBUPolicy Get method, leading to SQL injection and the potential to execute code in the underlying database context. Authentication is not required. Multiple con...

CVE-2017-17656

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup JobList method requests. The issue results...

CVE-2017-17419

Quest NetVault Backup 11.3.0.12 is affected by a remote SQL injection in NVBUTransferHistory Get requests due to improper validation of a user-supplied string used to build SQL queries. This can allow an attacker to execute arbitrary code in the context of the underlying database without authenti...

CVE-2017-17420

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobCountHistory Get method requests. The issue...

CVE-2017-17653

This CVE (CVE-2017-17653) affects Quest NetVault Backup 11.3.0.12. The vulnerability is a SQL injection in NVBUBackupOptionSet Get method requests due to improper validation of a user-supplied string used to build SQL queries, enabling remote code execution in the context of the underlying databa...

CVE-2017-17655

The CVE concerns Quest NetVault Backup (11.3.0.12). The vulnerability is a SQL injection in the NVBUBackup PluginList request handling, caused by improper validation of a user-supplied string used to construct SQL queries. This enables remote code execution in the context of the underlying databa...

CVE-2017-17656

CVE-2017-17656 affects Quest NetVault Backup (v11.3.0.12). The vulnerability is SQL injection in the NVBUBackup JobList handling, arising from insufficient validation of a user-supplied string before building SQL queries, enabling remote code execution in the database context. Authentication is n...