Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,570 results · page 21 of 32
Jun 2, 2019In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sCVE-2019-12564 · Other software · Douco · reported by MITRECritical 9.8
In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames.
- Product
- Douphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2019A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in unauCVE-2019-11894 · Other software · Bosch · reported by psirt@bosch.comMedium 5.7
A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup triggered by a legitimate user has been completed.
- Product
- Smart Home Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
May 22, 2019The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code.CVE-2018-14729 · Other software · Comsenz · reported by MITREHigh 8.8
The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code.
- Product
- Discuz!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2019ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component.CVE-2019-12170 · Other software · Atutor · reported by MITREHigh 8.8
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
- Product
- Atutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincidentsecurity.compacketstormsecurity.com
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
- Product
- WP Backup+ (aka WPbackupplus)
- Affected
- up to 2018-11-22
- What to do
- Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.opensuse.orgeasyhack.in
Apr 25, 2019core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.CVE-2019-11515 · Other software · Gilacms · reported by MITREMedium 4.9
core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.
- Product
- Gila CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisk123456.blogspot.comcisk123456.blogspot.com
Apr 24, 2019Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH.CVE-2019-3786 · Other software · Cloud Foundry · reported by security_alert@emc.comHigh 7.1
Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.
- Product
- BOSH Backup and Restore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Mar 30, 2019Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-bacCVE-2019-10662 · Other software · Grandstream · reported by MITREHigh 8.8
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.
- Product
- Ucm6204 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrustwave.com
Mar 29, 2019The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read fCVE-2017-18110 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.
- Product
- Crowd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Mar 21, 2019An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2.CVE-2019-9868 · Other software · Veritas · reported by MITREHigh 7.2
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator.
- Product
- Netbackup Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comveritas.com
Mar 21, 2019An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2.CVE-2019-9867 · Other software · Veritas · reported by MITREHigh 7.2
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator.
- Product
- Netbackup Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comveritas.com
Feb 11, 2019MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function wiCVE-2019-7731 · Other software · Mywebsql · reported by MITRECritical 9.8
MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename for the backup's archive file.
- Product
- Mywebsql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2019phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup database" option.CVE-2019-6691 · Websites & servers · Phpwind · reported by MITREHigh 7.2
phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup database" option.
- Product
- Phpwind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2019Premisys Identicard version 3.1.190 stores backup files as encrypted zip files.CVE-2019-3908 · Other software · Identicard · reported by vulnreport@tenable.comHigh 7.5
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
- Product
- Premisys ID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtenable.com
Oct 25, 2018A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root.CVE-2018-18652 · Other software · Veritas · reported by MITREHigh 7.2
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input.
- Product
- Netbackup Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comveritas.com
Oct 24, 2018Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/dirCVE-2018-18547 · Other software · Vestacp · reported by MITREMedium 6.1
Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnumanozdemir.com
Oct 18, 2018In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database bacCVE-2018-18487 · Other software · Gxlcms · reported by MITREHigh 7.5
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations.
- Product
- Gxlcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi.CVE-2018-16232 · Other software · Ipfire · reported by MITREHigh 8.8
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
- Product
- Ipfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoddsecurity.comipfire.org
Oct 9, 2018Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which wouldCVE-2018-2468 · Network & remote access · SAP · reported by cna@sap.comHigh 7.5
Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restricted.
- Product
- SAP Adaptive Server Enterprise (ASE)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
Oct 5, 2018A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information.CVE-2018-15433 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Oct 5, 2018A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information.CVE-2018-15432 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Oct 5, 2018The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archCVE-2014-10076 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
- Affected
- 2.2.4 to 2.2.4
- What to do
- Affects 2.2.4 to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Sep 23, 2018OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.CVE-2018-17364 · Other software · Otcms · reported by MITREHigh 8.1
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.
- Product
- Otcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxiaohuihui1.blogspot.comxiaohuihui1.blogspot.com
Aug 20, 2018Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Maintenance/configfile.cfgCVE-2018-14077 · Other software · Wi2be · reported by MITREHigh 7.5
Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Maintenance/configfile.cfg.
- Product
- Smart HP WMT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncode.comvulncode.com
Jun 12, 2018Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.CVE-2018-2425 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.4
Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.
- Product
- SAP Business One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlaunchpad.support.sap.com
Jun 8, 2018IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity oCVE-2017-1405 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 127392.
- Product
- Security Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jun 4, 2018The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and writCVE-2017-18285 · Other software · Burp Project · reported by MITREHigh 7.1
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.
- Product
- Burp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgsecurity.gentoo.org
Jun 4, 2018The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitraCVE-2017-18284 · Other software · Burp Project · reported by MITREHigh 7.1
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.
- Product
- Burp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgsecurity.gentoo.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).CVE-2018-11194 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).CVE-2018-11193 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).CVE-2018-11192 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).CVE-2018-11191 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).CVE-2018-11190 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).CVE-2018-11189 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).CVE-2018-11188 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).CVE-2018-11187 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).CVE-2018-11186 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).CVE-2018-11185 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).CVE-2018-11184 · Other software · Quest · reported by MITREHigh 7.2
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).CVE-2018-11183 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).CVE-2018-11182 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).CVE-2018-11181 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).CVE-2018-11180 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).CVE-2018-11179 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).CVE-2018-11178 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).CVE-2018-11177 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).CVE-2018-11176 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).CVE-2018-11175 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).CVE-2018-11174 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 1, 2018Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).CVE-2018-11173 · Other software · Quest · reported by MITREHigh 8.8
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
- Product
- Disk Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.