Arcserve UDP

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute any task as administrator.

Arcserve UDP Unauthenticated RCE

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

Arcserve UDP Agent Unauthenticated Path Traversal File Upload

Arcserve UDP Management Authentication Bypass

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

Arcserve UDP < 10.2 Authentication Bypass

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

Unauthenticated DoS in Arcserve Unified Data Protection

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue.

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclosure via /UDPUpdates/Config/FullUpdateSettings.xml issue.

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.

Arcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)