TI-2019-03005 CVE-2019-4001 · GHSA-vww8-2r48-h78w
Improper input validation in Druva inSync Client
Priority LOW 35
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
Druva
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9
Exploited now
Druva records in CISA KEVNo Druva vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Insync · all components
TI-2019-03004 CVE-2019-4000 · GHSA-pwwh-9mwx-42h3
Code injection in Druva inSync Mac OS Client
Priority LOW 35
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.
TI-2020-04726 CVE-2020-5798 · GHSA-wjv7-jqjx-m675
Incorrect default permissions in Druva inSync macOS Client Installers for v6.8.0 and prior
Priority LOW 34
inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.