Unitrends

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Unitrends records in CISA KEV

No Unitrends vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Enterprise Backup 8 records MEDIUM Backup 2 records HIGH

Records

8 records in Enterprise Backup · all components

TI-2014-02402 CVE-2014-3008 · GHSA-h2r3-7m2h-5fxq

Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary…

MEDIUM 52

Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06681 Published 2014-04-28 No fix listed CWE-78

TI-2017-04957 CVE-2017-7280 · GHSA-c75v-cjqc-8q53

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before…

MEDIUM 51

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06179 Published 2017-04-12 No fix listed CWE-20

TI-2017-04956 CVE-2017-7279 · GHSA-gmjg-wvw3-w3hh

An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can…

MEDIUM 49

An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04394 Published 2017-04-12 No fix listed CWE-565

TI-2017-04960 CVE-2017-7283 · GHSA-9x46-9ffj-c77f

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary…

MEDIUM 45

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles functi…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0428 Published 2017-04-20 No fix listed CWE-20

TI-2017-04958 CVE-2017-7281 · GHSA-hwfr-9r4g-vv62

An issue was discovered in Unitrends Enterprise Backup before 9.1.2.

MEDIUM 45

An issue was discovered in Unitrends Enterprise Backup before 9.1.2.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04318 Published 2017-04-12 No fix listed CWE-434

TI-2017-04961 CVE-2017-7284 · GHSA-fr4g-8pf8-pc9c

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server…

MEDIUM 43

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02656 Published 2017-04-12 No fix listed CWE-287

TI-2014-02508 CVE-2014-3139 · GHSA-m9wh-mhh5-hvhf

recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote…

LOW 39

recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03174 Published 2014-05-02 No fix listed CWE-287

TI-2017-04959 CVE-2017-7282 · GHSA-47pr-r85w-jwxj

An issue was discovered in Unitrends Enterprise Backup before 9.1.1.

LOW 32

An issue was discovered in Unitrends Enterprise Backup before 9.1.1.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.04281 Published 2017-04-20 No fix listed CWE-200

Open these records in search →

Critical	5
High	4
Medium	1
Low	0
No CVSS	0