Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,570 results · page 27 of 32
May 21, 2012Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control, which allows remote attackers tCVE-2012-2905 · Other software · Artiphp · reported by MITREMedium 5
Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.
- Product
- Artiphp CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2012CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (serCVE-2012-1662 · Other software · Broadcom · reported by MITREMedium 5
CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via a crafted network request.
- Product
- Arcserve Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Feb 17, 2012Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitCVE-2011-5081 · Other software · Backuppc · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.
- Product
- Backuppc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecunia.com
Feb 17, 2012Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary webCVE-2011-4923 · Other software · Backuppc · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361.
- Product
- Backuppc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2012Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitraryCVE-2011-3361 · Other software · Backuppc · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.
- Product
- Backuppc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackuppc.cvs.sourceforge.netbackuppc.cvs.sourceforge.net
Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
- Product
- myEASYbackup
- What to do
- Update myEASYbackup to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Dec 5, 2011The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of tCVE-2011-2397 · Other software · Ironmountain · reported by MITREHigh 10
The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method.
- Product
- Connected Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgzerodayinitiative.com
Jul 20, 2011Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, aCVE-2011-2261 · Other software · Oracle · reported by secalert_us@oracle.comHigh 10
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2011Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, aCVE-2011-2252 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.8
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2261.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2011Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectorsCVE-2011-2251 · Other software · Oracle · reported by secalert_us@oracle.comMedium 4.3
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2011Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4CVE-2011-1223 · Other software · IBM · reported by MITREHigh 7.2
Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors.
- Product
- Tivoli Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Jul 17, 2011Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6CVE-2011-1222 · Other software · IBM · reported by MITREHigh 7.2
Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows and AIX allows local users to gain privileges via unspecified vectors.
- Product
- Tivoli Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
May 31, 2011Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allowsCVE-2011-0546 · Other software · Symantec · reported by MITREMedium 6.5
Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allows man-in-the-middle attackers to execute NDMP commands via unspecified vectors.
- Product
- Backup Exec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2011Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackerCVE-2011-1736 · Other software · HP · reported by hp-security-alert@hp.comHigh 8.5
Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to read arbitrary files via directory traversal sequences in a filename in a GET_FILE message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1735 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed bm message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1734 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed omniiaputil message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1733 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed HPFGConfig message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1732 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed stutil message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1731 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_INTEGUTIL message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1730 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_SCRIPT message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1729 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed GET_FILE message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
May 7, 2011Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to eCVE-2011-1728 · Other software · HP · reported by hp-security-alert@hp.comHigh 10
Stack-based buffer overflow in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to execute arbitrary code via a malformed EXEC_BAR message.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh20000.www2.hp.comosvdb.org
Apr 9, 2011BackupConfig.php on the NetGear ProSafe WNAP210 allows remote attackers to obtain the administrator password by reading the configuration file.CVE-2011-1673 · Network & remote access · Netgear · reported by MITREMedium 5
BackupConfig.php on the NetGear ProSafe WNAP210 allows remote attackers to obtain the administrator password by reading the configuration file.
- Product
- Prosafe Wnap210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comkb.cert.org
Apr 9, 2011PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a diCVE-2011-1665 · Websites & servers · Phpboost · reported by MITREMedium 5
PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/.
- Product
- Phpboost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Feb 23, 2011The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x)CVE-2011-0532 · Other software · Fedoraproject · reported by Red HatMedium 6.2
The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
- Product
- 389 Directory Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredhat.comsecurityfocus.com
Jan 19, 2011Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vecCVE-2010-3596 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.4
Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2010Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.CVE-2010-4605 · Other software · IBM · reported by MITREMedium 6.6
Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows local users to overwrite arbitrary files via unknown vectors.
- Product
- Tivoli Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Dec 29, 2010Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli CVE-2010-4604 · Other software · IBM · reported by MITREHigh 7.2
Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable, and then sending a request over a pipe.
- Product
- Tivoli Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Dec 17, 2010RIM BlackBerry Desktop Software 4.7 through 6.0 for PC, and 1.0 for Mac, uses a weak password to encrypt a database backup file, which makes it easier for localCVE-2010-2603 · Other software · RIM · reported by MITRELow 2.1
RIM BlackBerry Desktop Software 4.7 through 6.0 for PC, and 1.0 for Mac, uses a weak password to encrypt a database backup file, which makes it easier for local users to decrypt the file via a brute force attack.
- Product
- Blackberry Desktop Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Oct 5, 2010The offline backup mechanism in Research In Motion (RIM) BlackBerry Desktop Software uses single-iteration PBKDF2, which makes it easier for local users to decrCVE-2010-3741 · Other software · RIM · reported by MITREMedium 4.7
The offline backup mechanism in Research In Motion (RIM) BlackBerry Desktop Software uses single-iteration PBKDF2, which makes it easier for local users to decrypt a .ipd file via a brute-force attack.
- Product
- Blackberry Desktop Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.crackpassword.comit.slashdot.org
Sep 7, 2010The automated-backup functionality in Blackboard Transact Suite (formerly Blackboard Commerce Suite) stores the (1) database username and (2) database password CVE-2010-3245 · Other software · Blackboard · reported by MITRELow 2.1
The automated-backup functionality in Blackboard Transact Suite (formerly Blackboard Commerce Suite) stores the (1) database username and (2) database password in cleartext in (a) script and (b) batch (.bat) files, which allows local users to obtain sensitive information by reading a file.
- Product
- Transact Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Aug 27, 2010Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and SP2, allowsCVE-2010-3145 · Computers, phones & browsers · Microsoft · reported by MITREHigh 9.3
Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and SP2, allows local users to gain privileges via a Trojan horse fveapi.dll file in the current working directory, as demonstrated by a directory that contains a Windows Backup Catalog (.wbcat) file, aka "Backup Manager Insecure Library Loading Vulnerability."
- Product
- Windows Vista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecuritytracker.com
Aug 25, 2010Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a ..CVE-2009-4978 · Other software · Tufat · reported by MITREMedium 5
Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
- Product
- Mybackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Aug 25, 2010PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_conCVE-2009-4977 · Other software · Tufat · reported by MITREMedium 6.5
PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter.
- Product
- Mybackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Jul 28, 2010Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a ..CVE-2009-4960 · Other software · Lanai-core · reported by MITREMedium 5
Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
- Product
- Lanai-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvupen.com
Jul 13, 2010Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, aCVE-2010-0907 · Other software · Oracle · reported by secalert_us@oracle.comHigh 10
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0899, CVE-2010-0904, and CVE-2010-0906.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2010Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown CVE-2010-0906 · Other software · Oracle · reported by secalert_us@oracle.comHigh 9
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2010Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.CVE-2010-0904 · Other software · Oracle · reported by secalert_us@oracle.comMedium 5
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityreason.com
Jul 13, 2010Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown CVE-2010-0899 · Other software · Oracle · reported by secalert_us@oracle.comHigh 9
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0907, and CVE-2010-0906.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2010Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.CVE-2010-0898 · Other software · Oracle · reported by secalert_us@oracle.comHigh 10
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2010Unspecified vulnerability in CA ARCserve Backup r11.5 SP4, r12.0 SP2, and r12.5 SP1 on Windows allows local users to obtain sensitive information via unknown veCVE-2010-2157 · Other software · reported by MITRELow 2.1
Unspecified vulnerability in CA ARCserve Backup r11.5 SP4, r12.0 SP2, and r12.5 SP1 on Windows allows local users to obtain sensitive information via unknown vectors.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
May 5, 2010Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execute arbitraCVE-2010-1686 · Other software · Abcbackup · reported by MITREHigh 9.3
Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP archive.
- Product
- ABC Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Mar 15, 2010The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which aCVE-2010-0123 · Other software · Timeclock-software · reported by PSIRT-CNA@flexerasoftware.comMedium 5
The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."
- Product
- Employee Timeclock Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 12, 2010Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, aCVE-2010-0072 · Other software · Oracle · reported by secalert_us@oracle.comHigh 10
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a buffer overflow in observiced.exe that allows remote attackers to execute arbitrary code via vectors related to a "reverse lookup of connections" to TCP port 10000.
- Product
- Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2009Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data ProCVE-2007-2280 · Other software · HP · reported by MITREHigh 10
Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments, a different vulnerability than CVE-2009-3844.
- Product
- Openview Storage Data Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecuritytracker.com
Dec 15, 2009Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain seCVE-2009-4303 · Other software · Moodle · reported by MITREMedium 5
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.moodle.orgdocs.moodle.org
Dec 11, 2009VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA throughCVE-2009-3027 · Other software · Symantec · reported by MITREHigh 10
VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command C
- Product
- Backup Exec Continuous Protection Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2009Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in theCVE-2009-4050 · Websites & servers · Phpmybackuppro · reported by MITREMedium 5
Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Phpmybackuppro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2009Multiple unspecified vulnerabilities in the (1) UNIX and (2) Linux backup-archive clients, and the (3) OS/400 API client, in IBM Tivoli Storage Manager (TSM) 5.CVE-2009-3855 · Other software · IBM · reported by MITREHigh 9.3
Multiple unspecified vulnerabilities in the (1) UNIX and (2) Linux backup-archive clients, and the (3) OS/400 API client, in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.6, 5.4 before 5.4.2, and 5.5 before 5.5.1, when the MAILPROG option is enabled, allow attackers to read, modify, or delete arbitrary files via unknown vectors.
- Product
- Tivoli Storage Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comwww-01.ibm.com
Oct 26, 2009common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allowCVE-2009-3611 · Other software · Le-web · reported by Red HatHigh 7.1
common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.
- Product
- Backintime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.gentoo.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.