CVE-2024-33672

CVE-2024-33672 affects Veritas NetBackup prior to 10.4. The Multi-Threaded Agent can be used to perform arbitrary file deletion on protected files, per multiple connected sources. Reported impact includes high confidentiality/availability implications (C/I = HIGH, A = HIGH) with local attack vect...

CVE-2022-36987

CVE-2022-36987 – Veritas NetBackup : The issue affects NetBackup in versions 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, and 9.x through 9.0.0.1, plus 9.1.x through 9.1.0.1. An attacker with authenticated access to a NetBackup Client could arbitrarily write files to a NetBackup Primary serve...

CVE-2023-28759

CVE-2023-28759 affects Veritas NetBackup on Windows prior to 10.0. The issue stems from the NetBackup client’s loading of DLLs, where path validation may allow a lower-privileged user to elevate privileges and compromise the system. Impact includes local privilege escalation; remediation is to up...

CVE-2022-36986

CVE-2022-36986 affects Veritas NetBackup: vulnerable versions include 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an unauthenticated attacker to remotely execute arbitrary commands on a NetBackup Primary server, via a remote execution path described in multip...

CVE-2020-36163

CVE-2020-36163 affects Veritas NetBackup and OpsCenter up to 8.3.0.1 on Windows. NetBackup processes using Strawberry Perl may load/execute libraries from paths that default Windows behavior permits to be created under C:\ by low-privilege users. If such a user places an affected library in that ...

CVE-2024-28222

CVE-2024-28222 affects Veritas NetBackup prior to 8.1.2 and NetBackup Appliance prior to 3.1.2. The BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file. Impact is impactful: high confidentiality, integrity, and availability r...

CVE-2020-36169

Veritas NetBackup (up to 8.3.0.1) and Veritas NetBackup OpsCenter (up to 8.3.0.1) on Windows are affected. The issue arises when processes using OpenSSL load and execute libraries from paths that Windows allows creating at the drive root. A low-privilege user could create an affected path and pla...

CVE-2022-36990

CVE-2022-36990 affects Veritas NetBackup, including versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Affected components: NetBackup Client and Primary server configuration. Vulnerability allows an attacker with authenticated access to a NetBackup Client to remotely write ...

CVE-2021-41570

Summary: CVE-2021-41570 affects Veritas NetBackup OpsCenter Analytics 9.1 and enables Cross-Site Scripting (XSS) by not properly escaping/filtering inputs in the Settings/Configuration Add flow. Affected component: NetBackup OpsCenter Analytics (version 9.1). Root cause: failure to effectively es...

CVE-2022-36950

Veritas NetBackup OpsCenter is affected by CVE-2022-36950 via unauthenticated Java classloader manipulation leading to remote code execution. Affected versions include 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10. Public advisories consistently describe an unauthenticated remote attacker able ...

CVE-2022-36991

Veritas NetBackup vulnerable versions: 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An authenticated NetBackup Client can arbitrarily write content to a partially controlled path on the NetBackup Primary server, due to a design/logic flaw in NetBackup components. The root caus...

CVE-2022-36954

Veritas NetBackup OpsCenter is affected by CVE-2022-36954. An authenticated remote attacker may be able to create or modify OpsCenter user accounts under specific conditions. Affected versions include NetBackup OpsCenter 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Mit...

CVE-2022-36995

CVE-2022-36995 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup Client to arbitrarily create directories on a NetBackup Primary server, revealing a path-based permission/control concern...

CVE-2022-36998

The CVE-2022-36998 issue affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The vulnerability is a stack-based buffer overflow on the NetBackup Primary server that can be triggered by an authenticated NetBackup Client, leading to DoS. The connected...

CVE-2022-36951

CVE-2022-36951 affects Veritas NetBackup OpsCenter. Affected versions include 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10. An unauthenticated remote attacker may compromise the host by exploiting a patched vulnerability. Remediation guidance provided by PT-2022-23698 recommends upgrading to l...

CVE-2022-36988

Veritas NetBackup CVE-2022-36988 affects NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup OpsCenter server, NetBackup Primary server, or NetBackup Media server to remotely execute arbitrary commands on...

CVE-2022-36952

CVE-2022-36952 affects Veritas NetBackup OpsCenter due to a hard-coded credential that can be used to exploit the VxSS subsystem. Affected versions are 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10. The issue is documented across multiple sources (NVD/NIST, Red Hat advisory, and third-party CVE...

CVE-2022-36996

CVE-2022-36996 affects Veritas NetBackup: vulnerable in versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Affected component is the NetBackup client’s ability to enumerate hosts known to a NetBackup Primary server when an attacker has client access. This results in informa...

CVE-2022-36955

CVE-2022-36955 — Veritas NetBackup privilege escalation : A local, unprivileged attacker able to access a NetBackup Client can issue specific commands to elevate privileges. Affected versions include 8.0–8.1.2, 8.2, 8.3–8.3.0.2, 9.0.0.0–9.0.0.1, and 9.1.0.0–9.1.0.1. The connected PT-2022-23702 en...

CVE-2022-36994

The CVE-2022-36994 issue affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Description: An attacker with authenticated access to a NetBackup Client could arbitrarily read files from a NetBackup Primary server. Root cause: improper access control a...

CVE-2022-36948

CVE-2022-36948 describes a DOM-based XSS in Veritas NetBackup OpsCenter. Affected versions are 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10. The connected PT-2022-23695 entry provides remediation guidance: upgrade to a version later than 8.3.0.2 for 8.x, later than 9.0.0.1 for 9.x, later than ...

CVE-2022-36993

CVE-2022-36993 affects Veritas NetBackup: multiple versions (8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1) are vulnerable. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server. The issue is confirmed acr...

CVE-2022-36989

CVE-2022-36989 affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An attacker with authenticated NetBackup Client access could remotely execute arbitrary commands on a NetBackup Primary server. The connected PT-2022-23733 entry provides remediation...

CVE-2022-36992

CVE-2022-36992 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server under specific notify conditions. Multiple sources (NVD, Re...

CVE-2022-36997

CVE-2022-36997 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an authenticated NetBackup Client with remote access to trigger arbitrary file reads, SSRF, and DoS. Root cause details are not provided in the connected documents. Public ex...

CVE-2022-36953

CVE-2022-36953 affects Veritas NetBackup OpsCenter. An unauthenticated remote attacker could gain sensitive information (information disclosure) via certain endpoints. Affected versions: 8.x through 8.3.0.2; 9.x through 9.0.0.1; 9.1.x through 9.1.0.1; and 10.0. The NVD CVSS base score is 4.3 (Net...

CVE-2022-36999

Summary: CVE-2022-36999 affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup Client to remotely read files on a NetBackup Primary server under certain conditions. Root cause/detail...

CVE-2022-37000

Veritas NetBackup vulnerability CVE-2022-37000 affects NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server. Several connect...

CVE-2022-42303

Veritas NetBackup (through v10.0 and related Veritas products) is affected by a SQL Injection issue in the NBFSMCLIENT service. CVE-2022-42302 describes the vulnerability in the NetBackup Primary server; CVE-2022-42303 notes a second-order SQL Injection vector leveraging CVE-2022-42302. Red Hat e...

CVE-2017-8858

CVE-2017-8858 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The issue is an unauthenticated, privileged remote file write via the bprd process. This is a remote, unauthenticated threat with high impact (CVE-2017-8858 is disclosed in multiple sources; no exploi...

CVE-2022-36949

This CVE affects Veritas NetBackup OpsCenter versions 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10, where an attacker with local access could potentially escalate privileges. Root cause and exploit details are not expanded beyond local access privilege escalation in the provided documents. Mit...

CVE-2022-45461

Summary of CVE-2022-45461 (Veritas NetBackup) : The issue affects the Java Admin Console in Veritas NetBackup (through version 10.1) on Linux/UNIX. Authentication by non-root users who are added to auth.conf may lead to arbitrary commands being executed as root, due to failure to neutralize speci...

CVE-2017-6406

CVE-2017-6406 affects Veritas NetBackup (Before 7.7.2) and NetBackup Appliance (Before 2.7.2). It enables arbitrary privileged command execution via a whitelist directory escape using substrings like "../". The root cause is a directory traversal that can lead to privilege escalation with local a...

CVE-2022-42299

CVE-2022-42299 describes a denial-of-service vulnerability in Veritas NetBackup up to 10.0.0.1, exploitable via the DiscoveryService on the NetBackup Primary server. Connected sources corroborate the impact (availability loss) and indicate the issue affects NetBackup and related Veritas products....

CVE-2017-6403

CVE-2017-6403 affects Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. The vulnerability arises in NetBackup Cloud Storage Service which uses a hardcoded username and password. Public data lists CVSS v3.0 base score 9.8 (CRITICAL) with network access, no privileges required, and h...

CVE-2022-36984

Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1 are affected by CVE-2022-36984. The issue allows an attacker with authenticated access to a NetBackup Client to remotely trigger a denial-of-service against a NetBackup Primary server. The root cause is not...

CVE-2015-6552

Veritas NetBackup 7.x (and NetBackup Appliance) is affected by CVE-2015-6552 due to a vulnerability in the management-services protocol that permits remote attackers to make arbitrary RPC calls via unspecified vectors. Affected versions include NetBackup 7.x up to 7.7.1.x and NetBackup Appliance ...

CVE-2017-6400

CVE-2017-6400 affects Veritas NetBackup Server/Client (and NetBackup Appliance) before versions 7.7.2 and 2.7.2 respectively. The issue enables privileged command execution on the local system. Based on the sources, the vulnerability arises on local access with low complexity and no authenticatio...

CVE-2017-8857

CVE-2017-8857 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The vulnerability is in the bprd process and allows unauthenticated file copy and arbitrary remote command execution. The connected sources confirm an unauthenticated path via the bprd service that en...

CVE-2022-42306

Summary: CVE-2022-42306 affects Veritas NetBackup (and related Veritas products) prior to 8.3. A local attacker can send a crafted packet to the pbx_exchange component during registration, triggering a NULL pointer dereference that crashes the pbx_exchange process (denial of service). Affected ve...

CVE-2004-1389

Summary: CVE-2004-1389 describes an unknown vulnerability in the Veritas NetBackup Administrative Assistant interfaces across multiple NetBackup products (BusinesServer 3.4/3.4.1/4.5, DataCenter 3.4/3.4.1/4.5, Enterprise Server 5.1, NetBackup Server 5.0/5.1) that allows arbitrary command executio...

CVE-2022-36985

CVE-2022-36985 affects Veritas NetBackup on Windows: vulnerable in NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An unprivileged local attacker on a NetBackup Primary server could escalate privileges. Connected documents confirm affected versions and local-privilege-e...

CVE-2022-42302

The connected Red Hat and NVD entries confirm CVE-2022-42302 affects Veritas NetBackup up to version 10.0 and related Veritas products, with the NetBackup Primary server vulnerable via the NBFSMCLIENT service to a SQL Injection. This is the underlying cause and is tied to high-impact outcomes (C,...

CVE-2022-42308

CVE-2022-42308 affects Veritas NetBackup (and related Veritas products) prior to 8.3. A path traversal in the pbx_exchange registration code allows a local attacker to delete arbitrary files. Impact: local access required; integrity and availability impact reported as high; confidentiality not af...

CVE-2015-6550

CVE-2015-6550 affects Veritas NetBackup: the bpcd service in NetBackup 7.x (including 7.5.0.7, 7.6.x, and 7.7.x before 7.7.2) and NetBackup Appliance up to 2.7.x is exploitable via crafted input to trigger remote command execution. Affected versions include 7.5.0.7, 7.6.0.x–7.6.0.4, 7.6.1.x–7.6.1...

CVE-2017-6401

CVE-2017-6401 affects Veritas NetBackup (before 8.0) and NetBackup Appliance (before 3.0). The issue enables local arbitrary command execution when using the bpcd and bpnbat components. The connected documents corroborate the affected products and the local-execution vector but do not provide con...

CVE-2017-6402

CVE-2017-6402 describes a denial-of-service issue affecting Veritas NetBackup Server on NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The provided sources consistently identify the affected products and versions, but do not disclose the underlying root cause, technical exploi...

CVE-2017-6405

Veritas NetBackup products (NetBackup 8.0 and earlier; NetBackup Appliance 3.0 and earlier) are affected by a DNS spoofing vulnerability due to hostname-based security. The connected documents confirm the issue but do not provide exploit details or remediation steps within the provided content.

CVE-2024-52945

CVE-2024-52945 affects Veritas NetBackup before 10.5 on Windows. The issue arises when a user executes certain NetBackup commands (or is social-engineered to do so), allowing a malicious DLL to load and execute the attacker’s code in the user’s security context. Root cause cited in PT-2024-8334 i...

CVE-2017-6399

Veritas NetBackup (Server/Client) prior to 7.7.2 and NetBackup Appliance prior to 2.7.2/3.1.0 is affected by a Privileged remote command execution vulnerability. Multiple connected advisories (Veritas VTS17-003, CNVD/CVE-2017-6399) confirm an arbitrary/root-level command execution vector on the N...