This page lists publicly disclosed CVE vulnerabilities affecting veritas netbackup (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2024-52945 | An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resulting in execution of the attacker's code in the user's security context. | [email protected] | 7.8 | 0.19% | 2024-11-18 | 2025-04-30 |
| CVE-2024-33672 | An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files. | [email protected] | 7.7 | 0.04% | 2024-04-26 | 2025-06-10 |
| CVE-2024-28222 | In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file. | [email protected] | 9.8 | 1.41% | 2024-03-07 | 2025-01-21 |
| CVE-2023-28759 | An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may allow a lower-level user to elevate privileges and compromise the system. | [email protected] | 7.8 | 0.15% | 2023-03-23 | 2025-02-25 |
| CVE-2023-28758 | An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files. | [email protected] | 7.1 | 0.04% | 2023-03-23 | 2025-02-25 |
| CVE-2022-45461 | The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root. | [email protected] | 7.5 | 1.46% | 2022-11-17 | 2025-04-29 |
| CVE-2022-42308 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx_exchange registration code. | [email protected] | 9.0 | 0.04% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42307 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service. | [email protected] | 5.3 | 0.18% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42306 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process. | [email protected] | 6.5 | 0.02% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42305 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal attack through the DiscoveryService service. | [email protected] | 5.3 | 0.42% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42304 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code. | [email protected] | 8.0 | 0.65% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42303 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Injection attack affecting the NBFSMCLIENT service by leveraging CVE-2022-42302. | [email protected] | 8.0 | 0.65% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42302 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting the NBFSMCLIENT service. | [email protected] | 9.0 | 0.71% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42301 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process. | [email protected] | 5.4 | 0.24% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42300 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.) | [email protected] | 4.3 | 0.54% | 2022-10-03 | 2024-11-21 |
| CVE-2022-42299 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service. | [email protected] | 5.3 | 0.28% | 2022-10-03 | 2024-11-21 |
| CVE-2022-37000 | An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server. | [email protected] | 6.5 | 0.27% | 2022-07-28 | 2024-11-21 |
| CVE-2022-36999 | An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server. | [email protected] | 6.5 | 0.27% | 2022-07-28 | 2024-11-21 |
| CVE-2022-36998 | An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger a stack-based buffer overflow on the NetBackup Primary server, resulting in a denial of service. | [email protected] | 6.3 | 0.25% | 2022-07-28 | 2024-11-21 |
| CVE-2022-36997 | An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger impacts that include arbitrary file read, Server-Side Request Forgery (SSRF), and denial of service. | [email protected] | 7.1 | 0.36% | 2022-07-28 | 2024-11-21 |