CVE-2017-17421

CVE-2017-17421 affects Quest NetVault Backup (notably 11.3.0.12); a SQL injection in NVBUSelectionSet Get requests allows remote code execution with no authentication. Root cause: improper validation of a user-supplied string used to build SQL queries. Documents indicate potential exploit paths a...

CVE-2018-1162

Summary: CVE-2018-1162 describes a denial-of-service vulnerability in Quest NetVault Backup 11.2.0.13 due to a path validation flaw. The flaw occurs in the handling of Export requests where a user-supplied path isn’t properly validated before file operations, allowing an attacker to arbitrarily o...

CVE-2017-17417

Quest NetVault Backup Server (Quest NetVault Backup) is affected by CVE-2017-17417 due to an SQL Injection in the Process Manager Service NVBUPhaseStatus Acknowledge handling. Affects versions prior to 11.4.5 (e.g., 11.3.0.12 referenced in sources). The vulnerability allows unauthenticated remote...

CVE-2018-1163

CVE-2018-1163 affects Quest NetVault Backup 11.2.0.13. The vulnerability is a checksession authentication bypass in the web interface’s JSON RPC handling, allowing an unauthenticated attacker to bypass authentication and access critical functions. The description notes this could be combined with...

CVE-2017-17416

CVE-2017-17416 affects Quest NetVault Backup (v11.3.0.12) with a SQL injection in NVBUPhaseStatus GetPlugins handling that allows remote code execution in the database context. The flaw results from insufficient validation of a user-supplied string used to build SQL queries, and authentication is...

CVE-2017-17658

CVE-2017-17658 affects Quest NetVault Backup 11.3.0.12. The vulnerability is a SQL injection in the NVBUJobDefinitions Get method, caused by insufficient validation of a user-supplied string before constructing SQL queries. Exploitation does not require authentication, allowing remote attackers t...

CVE-2017-17657

CVE-2017-17657 affects Quest NetVault Backup, where NVBUBackup TimeRange method requests are mishandled due to insufficient validation of a user-supplied string used in SQL queries. This enables remote code execution with the database context and does not require authentication. Documented in mul...

CVE-2017-17424

CVE-2017-17424 affects Quest NetVault Backup, specifically vulnerable in the NVBUScheduleSet Get method handling. The issue is a SQL injection due to improper validation of a user-supplied string used to construct SQL queries, allowing remote attackers to execute arbitrary code in the context of ...

CVE-2018-1161

Summary of findings : CVE-2018-1161 affects Quest NetVault Backup 11.2.0.13, with a vulnerability in the nvwsworker.exe component. The flaw occurs when parsing the boundary header of a multipart request, where the process fails to validate the length of user-supplied data before copying it to a s...

CVE-2017-17412

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET method requests. The issue results from the lack o...

CVE-2017-17414

Quest NetVault Backup 11.3.0.12 is affected by a SQL injection in the NVBUPhaseStatus Get method, caused by unvalidated user input used to build SQL queries. This allows remote code execution with no authentication, running in the database context. Affected product/version details in the provided...

CVE-2017-17417

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. The issue...

CVE-2017-17422

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Get method requests. The issue results from...

CVE-2017-17423

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupSegment Get method requests. The issue resul...

CVE-2017-17658

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue...

CVE-2017-17419

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue...

CVE-2017-17420

CVE-2017-17420 affects Quest NetVault Backup (Server Process Manager Service) via an SQL injection in NVBUJobCountHistory Get method. The root cause is improper validation of user-supplied input used to construct SQL queries, enabling unauthenticated remote code execution in the database context....

CVE-2017-17412

The CVE-2017-17412 issue affects Quest NetVault Backup (version 11.3.0.12). It is an SQL injection in the NVBUEventHistory Get method/JSON-RPC Get path caused by improper validation of user-supplied input used to construct SQL queries, enabling remote code execution in the database context. Explo...

CVE-2017-17425

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSourceDeviceSet Get method requests. The issue...

CVE-2017-17414

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Get method requests. The issue results...