CVE-2015-4068

Arcserve UDP vulnerable versions:

CVE-2023-41998

Summary: CVE-2023-41998 affects Arcserve UDP prior to 9.2 via the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine allows uploading and executing arbitrary files, enabling unauthenticated remote exploitation as described in multiple sources. Affected product/version: Arcserv...

CVE-2023-42000

CVE-2023-42000 affects Arcserve UDP, with a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload() that allows unauthenticated remote attackers to upload arbitrary files to locations on the UDP agent’s file system. Affected: Arcserve UDP prior to 9.2. Imp...

CVE-2023-41999

Summary: CVE-2023-41999 affects Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier, allowing authentication to the management console and action on authenticated tasks. What’s affected: Arcserve UDP (management console) before v9.2....

CVE-2018-18660

Arcserve UDP (Arcserve Unified Data Protection) up to 6.5 Update 4 is affected by a reflected Cross-Site Scripting (XSS) in /authenticationendpoint/domain.jsp (DDI-VRT-2018-21). Root cause is input handling leading to script injection; this is a client-side vulnerability that could affect users i...

CVE-2025-34520

CVE-2025-34520 describes an authentication bypass in Arcserve Unified Data Protection (UDP). The issue allows unauthenticated attackers to access administrator-level features by manipulating request parameters or exploiting a logic flaw. Affected: UDP versions prior to 10.2. Patches exist in 10.2...

CVE-2025-34523

CVE-2025-34523 / CVE-2025-34522 (Arcserve UDP) describe heap-based buffer overflow vulnerabilities in the network-facing/input parsing routines of Arcserve Unified Data Protection (UDP). The flaws are pre-authentication and triggered by attacker-controlled input with improper bounds checking, all...

CVE-2025-34522

Arcserve UDP contains a pre-auth heap-based buffer overflow in its input parsing logic (UDP

CVE-2025-34521

CVE-2025-34521 – Arcserve UDP XSS : A reflected cross-site scripting vulnerability exists in the Arcserve Unified Data Protection web interface, where unsanitized input is reflected in HTTP responses. This can allow remote attackers with low privileges to craft malicious links that, when a user v...