MediumCVSS 5.4
EPSS 0.21%
InfoScale VIOM 9.1.3 allows XSS.
Vendor
veritas vulnerabilities
144 published CVES affecting veritas, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 144
- Critical
- 40
- High
- 65
- Medium
- 39
- Low
- 0
- Unscored
- 0
- CISA KEV
- 4
Products
- netbackup 67
- netbackup appliance 41
- flex appliance 19
- enterprise vault 17
- flex scale 17
- infoscale operations manager 9
- backup exec 8
- aptare 6
- netbackup flex scale appliance 6
- access appliance 5
- resiliency platform 5
- system recovery 5
- access 4
- Data Insight 3
- desktop and laptop option 3
- aptare it analytics 2
- infoscale 2
- netbackup appliance firmware 2
- opscenter 2
- bare metal restore 1
- cloudpoint 1
- cluster server 1
- ediscovery platform 1
- netbackup cloudpoint 1
- netbackup it analytics 1
- netbackup opscenter 1
- netbackup snapshot manager 1
- netbackup virtual appliance 1
- storage foundation 1
- storage foundation and high availability 1
Latest veritas CVEs
Newest publication first · page 1 of 6
-
-
HighCVSS 8.8 EPSS 0.20%
Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into clicking a malicious HTML link, which triggers unintended modifications on VIOM web application without the user's knowl...
-
MediumCVSS 6.5 EPSS 0.31%
SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.
-
HighCVSS 8.5 EPSS 0.17%
Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malici...
-
MediumCVSS 4.7 EPSS 0.14%
Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server.
-
MediumCVSS 6.5 EPSS 0.59%
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
CriticalCVSS 9.8 EPSS 0.94%
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
-
MediumCVSS 5.4 EPSS 1.2%
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an a...
-
HighCVSS 7.8 EPSS 0.23%
An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a...
-
MediumCVSS 5.4 EPSS 0.37%
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an a...
-
MediumCVSS 5.4 EPSS 0.37%
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authent...
-
MediumCVSS 6.1 EPSS 0.75%
An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user.
-
HighCVSS 8.4 EPSS 0.25%
Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks.
-
HighCVSS 7.8 EPSS 0.16%
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path.
-
HighCVSS 7.1 EPSS 0.17%
An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files.
-
HighCVSS 7.1 EPSS 0.17%
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.
-
CriticalCVSS 9.8 EPSS 0.99%
In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file.
-
HighCVSS 7.2 EPSS 0.68%
A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary locations on the server on which the application is installed.
-
CriticalCVSS 9.8 EPSS 0.40%
A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.