CVE-2017-12478

Unitrends UEB (Unitrends Backup) before 10.0.0 is affected by an input validation flaw in the api/storage web interface that allows remote authentication bypass and arbitrary command execution with root privileges. The issue has been exploited in multiple public advisories and exploits (e.g., Exp...

CVE-2017-12477

Unitrends UEB bpserverd in UB versions prior to 10.0.0 is vulnerable to an authentication bypass via the bpserverd protocol exposed through xinetd, enabling remote root command execution. Public references (exploit-db, metasploit, OpenVAS entries) document the RCE actions. Affected: Unitrends Bac...

CVE-2018-6328

CVE-2018-6328 affects Unitrends Backup/UEB before 10.1.0 where the UI authentication bypass can allow an unauthenticated user to inject commands into /api/hosts via backquotes. The vulnerability enables remote code execution with high impact, as described in public references and exploit entries....