CVE-2022-22965

CVE-2022-22965 (Spring4Shell) affects Spring Framework’s Spring MVC and Spring WebFlux when data binding is enabled in apps running on JDK 9+, with exploitation requiring Tomcat as WAR deployment. The issue is not exploited in Spring Boot executable jars. Vulnerable configurations are associated ...

CVE-2022-36987

CVE-2022-36987 – Veritas NetBackup : The issue affects NetBackup in versions 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, and 9.x through 9.0.0.1, plus 9.1.x through 9.1.0.1. An attacker with authenticated access to a NetBackup Client could arbitrarily write files to a NetBackup Primary serve...

CVE-2022-36986

CVE-2022-36986 affects Veritas NetBackup: vulnerable versions include 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an unauthenticated attacker to remotely execute arbitrary commands on a NetBackup Primary server, via a remote execution path described in multip...

CVE-2024-28222

CVE-2024-28222 affects Veritas NetBackup prior to 8.1.2 and NetBackup Appliance prior to 3.1.2. The BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file. Impact is impactful: high confidentiality, integrity, and availability r...

CVE-2022-36990

CVE-2022-36990 affects Veritas NetBackup, including versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Affected components: NetBackup Client and Primary server configuration. Vulnerability allows an attacker with authenticated access to a NetBackup Client to remotely write ...

CVE-2022-36991

Veritas NetBackup vulnerable versions: 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An authenticated NetBackup Client can arbitrarily write content to a partially controlled path on the NetBackup Primary server, due to a design/logic flaw in NetBackup components. The root caus...

CVE-2022-36995

CVE-2022-36995 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup Client to arbitrarily create directories on a NetBackup Primary server, revealing a path-based permission/control concern...

CVE-2022-36988

Veritas NetBackup CVE-2022-36988 affects NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup OpsCenter server, NetBackup Primary server, or NetBackup Media server to remotely execute arbitrary commands on...

CVE-2022-36998

The CVE-2022-36998 issue affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The vulnerability is a stack-based buffer overflow on the NetBackup Primary server that can be triggered by an authenticated NetBackup Client, leading to DoS. The connected...

CVE-2022-36996

CVE-2022-36996 affects Veritas NetBackup: vulnerable in versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Affected component is the NetBackup client’s ability to enumerate hosts known to a NetBackup Primary server when an attacker has client access. This results in informa...

CVE-2022-36994

The CVE-2022-36994 issue affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Description: An attacker with authenticated access to a NetBackup Client could arbitrarily read files from a NetBackup Primary server. Root cause: improper access control a...

CVE-2022-36989

CVE-2022-36989 affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An attacker with authenticated NetBackup Client access could remotely execute arbitrary commands on a NetBackup Primary server. The connected PT-2022-23733 entry provides remediation...

CVE-2022-36992

CVE-2022-36992 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server under specific notify conditions. Multiple sources (NVD, Re...

CVE-2022-36993

CVE-2022-36993 affects Veritas NetBackup: multiple versions (8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1) are vulnerable. An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server. The issue is confirmed acr...

CVE-2022-36997

CVE-2022-36997 affects Veritas NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an authenticated NetBackup Client with remote access to trigger arbitrary file reads, SSRF, and DoS. Root cause details are not provided in the connected documents. Public ex...

CVE-2022-36999

Summary: CVE-2022-36999 affects Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. The issue allows an attacker with authenticated access to a NetBackup Client to remotely read files on a NetBackup Primary server under certain conditions. Root cause/detail...

CVE-2017-8858

CVE-2017-8858 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The issue is an unauthenticated, privileged remote file write via the bprd process. This is a remote, unauthenticated threat with high impact (CVE-2017-8858 is disclosed in multiple sources; no exploi...

CVE-2022-37000

Veritas NetBackup vulnerability CVE-2022-37000 affects NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server. Several connect...

CVE-2017-6406

CVE-2017-6406 affects Veritas NetBackup (Before 7.7.2) and NetBackup Appliance (Before 2.7.2). It enables arbitrary privileged command execution via a whitelist directory escape using substrings like "../". The root cause is a directory traversal that can lead to privilege escalation with local a...

CVE-2017-6403

CVE-2017-6403 affects Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. The vulnerability arises in NetBackup Cloud Storage Service which uses a hardcoded username and password. Public data lists CVSS v3.0 base score 9.8 (CRITICAL) with network access, no privileges required, and h...

CVE-2022-36984

Veritas NetBackup versions 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1 are affected by CVE-2022-36984. The issue allows an attacker with authenticated access to a NetBackup Client to remotely trigger a denial-of-service against a NetBackup Primary server. The root cause is not...

CVE-2017-6400

CVE-2017-6400 affects Veritas NetBackup Server/Client (and NetBackup Appliance) before versions 7.7.2 and 2.7.2 respectively. The issue enables privileged command execution on the local system. Based on the sources, the vulnerability arises on local access with low complexity and no authenticatio...

CVE-2015-6552

Veritas NetBackup 7.x (and NetBackup Appliance) is affected by CVE-2015-6552 due to a vulnerability in the management-services protocol that permits remote attackers to make arbitrary RPC calls via unspecified vectors. Affected versions include NetBackup 7.x up to 7.7.1.x and NetBackup Appliance ...

CVE-2017-6405

Veritas NetBackup products (NetBackup 8.0 and earlier; NetBackup Appliance 3.0 and earlier) are affected by a DNS spoofing vulnerability due to hostname-based security. The connected documents confirm the issue but do not provide exploit details or remediation steps within the provided content.

CVE-2017-8857

CVE-2017-8857 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The vulnerability is in the bprd process and allows unauthenticated file copy and arbitrary remote command execution. The connected sources confirm an unauthenticated path via the bprd service that en...

CVE-2015-6550

CVE-2015-6550 affects Veritas NetBackup: the bpcd service in NetBackup 7.x (including 7.5.0.7, 7.6.x, and 7.7.x before 7.7.2) and NetBackup Appliance up to 2.7.x is exploitable via crafted input to trigger remote command execution. Affected versions include 7.5.0.7, 7.6.0.x–7.6.0.4, 7.6.1.x–7.6.1...

CVE-2017-6409

CVE-2017-6409 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Unauthenticated CORBA interfaces permit inappropriate access, enabling potential disclosure or manipulation of sensitive data and resources. The CVSS metrics in the public record indicate high impact ...

CVE-2022-36985

CVE-2022-36985 affects Veritas NetBackup on Windows: vulnerable in NetBackup 8.1.x–8.1.2, 8.2, 8.3.x–8.3.0.2, 9.x–9.0.0.1, and 9.1.x–9.1.0.1. An unprivileged local attacker on a NetBackup Primary server could escalate privileges. Connected documents confirm affected versions and local-privilege-e...

CVE-2017-6401

CVE-2017-6401 affects Veritas NetBackup (before 8.0) and NetBackup Appliance (before 3.0). The issue enables local arbitrary command execution when using the bpcd and bpnbat components. The connected documents corroborate the affected products and the local-execution vector but do not provide con...

CVE-2017-6402

CVE-2017-6402 describes a denial-of-service issue affecting Veritas NetBackup Server on NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The provided sources consistently identify the affected products and versions, but do not disclose the underlying root cause, technical exploi...

CVE-2017-6399

Veritas NetBackup (Server/Client) prior to 7.7.2 and NetBackup Appliance prior to 2.7.2/3.1.0 is affected by a Privileged remote command execution vulnerability. Multiple connected advisories (Veritas VTS17-003, CNVD/CVE-2017-6399) confirm an arbitrary/root-level command execution vector on the N...

CVE-2017-6407

CVE-2017-6407 affects Veritas NetBackup before 7.7.2 and NetBackup Appliance before 2.7.2. The issue allows privileged remote command execution on NetBackup Server and on a connected NetBackup client (server or client side). The vulnerability’s root cause is described as a privileged remote comma...

CVE-2019-9868

Affected product: Veritas NetBackup Appliance Web Console (versions up to 3.1.2). Issue: SMTP password is disclosed to an administrator via the Web Console UI. Root cause details are not provided in the given documents. Impact: potential exposure of SMTP credentials to users with Web Console acce...

CVE-2017-8856

CVE-2017-8856 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The vulnerability arises from improper directory whitelisting in the bprd process, allowing unauthenticated, remote command execution. Impact is remote code execution with root/administrator privilege...

CVE-2017-6408

CVE-2017-6408 affects Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. The issue is a local-privilege-escalation race condition in the pbx_exchange component that can occur when a local user connects to a socket before permissions are secured. The impact is privilege esc...

CVE-2017-8859

Veritas NetBackup Appliance 2.7.x and 3.0.x are affected by a remote command execution vulnerability. An unauthenticated attacker can issue a crafted GET request (via /appliancews/getLicense with a hostName parameter) to execute arbitrary commands as root due to improper input validation. Nessus ...

CVE-2015-6551

Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4, and NetBackup Appliance through 2.5.4 and 2.6.0.x through 2.6.0.4, expose an information-disclosure vulnerability due to not using TLS for administration-console traffic to the NBU server. This allows a remote attacker to sniff ke...

CVE-2017-6404

Veritas NetBackup before 7.7 and NetBackup Appliance before 2.7 contain a vulnerability where world-writable log files can be destroyed or spoofed. This is documented in CVE-2017-6404 and reflected across multiple sources (NVD entry; Nessus plugin). The initial disclosures do not provide remediat...

CVE-2018-18652

The CVE-2018-18652 entry concerns Veritas NetBackup Appliance prior to 3.1.2. It describes a remote command execution vulnerability caused by insufficient filtering of user-provided input, permitting authenticated administrators to execute arbitrary commands as root. The connected sources substan...

CVE-2019-9867

The CVE-2019-9867 issue affects Veritas NetBackup Appliance Web Console up to version 3.1.2, where the proxy server password is disclosed to an administrator. The available records do not specify the root cause details, vulnerable component version beyond the Web Console, or explicit exploitation...

CVE-2023-37237

The CVE-2023-37237 issue affects Veritas NetBackup Appliance software prior to 4.1.0.1 MR3. Insecure permissions allow an authenticated Admin to bypass shell restrictions and execute arbitrary OS commands via SSH. Root cause: insecure permissions on the appliance environment. Impact: potential fu...