Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
unitrends vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv2
CVE-2017-7284
An attacker that has hijacked a Unitrends Enterprise Backup (prior to 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover.
Unitrends Enterprise Backup
7.5
CVSSv2
CVE-2017-7280
An issue exists in api/includes/systems.php in Unitrends Enterprise Backup prior to 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.
Unitrends Enterprise Backup
7.5
CVSSv2
CVE-2018-6328
It exists that the Unitrends Backup (UB) prior to 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
Kaseya Unitrends Backup
1 EDB exploit
10
CVSSv2
CVE-2017-12478
It exists that the api/storage web interface in Unitrends Backup (UB) prior to 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the targ...
Kaseya Unitrends Backup
3 EDB exploits
9
CVSSv2
CVE-2017-12479
It exists that an issue in the session logic in Unitrends Backup (UB) prior to 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could t...
Kaseya Unitrends Backup
1 EDB exploit
7.5
CVSSv2
CVE-2014-3139
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote malicious users to bypass authentication by setting the auth parameter to a certain string.
Unitrends Enterprise Backup 7.3.0
1 EDB exploit
10
CVSSv2
CVE-2014-3008
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.
Unitrends Enterprise Backup 7.3.0
1 EDB exploit
9
CVSSv2
CVE-2021-40385
An issue exists in the server software in Kaseya Unitrends Backup Software prior to 10.5.5-2. There is a privilege escalation from read-only user to admin.
Kaseya Unitrends Backup Software
9
CVSSv2
CVE-2021-40387
An issue exists in the server software in Kaseya Unitrends Backup Software prior to 10.5.5-2. There is authenticated remote code execution.
Kaseya Unitrends Backup Software
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654
CVE-2024-2757
authentication bypass
CVE-2024-3194
CVE-2024-33640
CVE-2024-21111
dos
insecure direct object reference
CVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3