Unitrends Enterprise Backup — known CVE vulnerabilities

Every CVE whose affected-product data names Unitrends Enterprise Backup, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2014-3008 — CVSS 10.0 (critical): Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm…
• CVE-2017-7280 — CVSS 9.8 (critical): An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before…
• CVE-2017-7279 — CVSS 9.8 (critical): An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token"…
• CVE-2017-7284 — CVSS 8.8 (high): An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change…
• CVE-2017-7281 — CVSS 8.8 (high): An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and…
• CVE-2017-7283 — CVSS 8.8 (high): An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename…
• CVE-2014-3139 — CVSS 7.5 (high): recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth…
• CVE-2017-7282 — CVSS 5.5 (medium): An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts…