Druva

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Druva records in CISA KEV

No Druva vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Insync Client 6 records MEDIUM Insync 3 records LOW

Records

6 records in Insync Client · all components

TI-2020-04680 CVE-2020-5752 · GHSA-w3p2-35c9-4q59

Path traversal in Druva inSync Windows Client

MEDIUM 45

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.08607 Published 2020-05-21 No fix listed CWE-22

TI-2019-03003 CVE-2019-3999 · GHSA-xm72-wm3m-qgm7

OS command injection in Druva inSync Windows Client

MEDIUM 45

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.08566 Published 2020-02-25 No fix listed CWE-78

TI-2021-14832 CVE-2021-36667 · GHSA-gjvp-gq3c-wh68

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to…

LOW 39

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.02666 Published 2022-07-11 No fix listed CWE-78

TI-2021-14833 CVE-2021-36668 · GHSA-g5cr-h9h3-pj49

URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an…

LOW 35

URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00577 Published 2022-07-11 No fix listed CWE-74

TI-2021-14830 CVE-2021-36665 · GHSA-h2q6-h25w-cr2p

An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated…

LOW 35

An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00507 Published 2022-07-11 No fix listed CWE-502

TI-2021-14831 CVE-2021-36666 · GHSA-5rc3-9cqf-fhjx

An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated…

LOW 34

An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00458 Published 2022-07-11 No fix listed CWE-426

Open these records in search →

Critical	0
High	9
Medium	0
Low	0
No CVSS	0