VendorsHPdata_protectorall versions
Vulnerabilities

HP Data Protector

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

14CVEs
CVE-2011-0923
The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the "local bin directory."
Published 2011-02-09 · Modified
10.05 PoCEPSS 0.811
CVE-2011-0922
The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.
Published 2011-02-09 · Modified
10.03 PoCEPSS 0.642
CVE-2017-5807
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Published 2018-02-15 · Modified
10.0EPSS 0.219
CVE-2016-2005
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352.
Published 2016-04-21 · Modified
10.0EPSS 0.204
CVE-2016-2006
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353.
Published 2016-04-21 · Modified
10.0EPSS 0.204
CVE-2016-2007
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354.
Published 2016-04-21 · Modified
10.0EPSS 0.204
CVE-2011-0921
crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname, domain, and username, which allows remote attackers to execute arbitrary code by sending unspecified data over TCP, related to the webreporting client, the applet domain, and the java username.
Published 2011-02-09 · Modified
10.0EPSS 0.113
CVE-2011-0924
The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command, which allows remote attackers to execute arbitrary script code by providing this code with a trusted filename, as demonstrated by omni_chk_ds.sh.
Published 2011-02-09 · Modified
10.0EPSS 0.046
CVE-2016-2004
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
Published 2016-04-21 · Modified
9.82 PoCEPSS 0.943
CVE-2016-2008
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.
Published 2016-04-21 · Modified
9.8EPSS 0.105
CVE-2017-5808
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Published 2018-02-15 · Modified
7.8EPSS 0.161
CVE-2011-2399
Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows remote attackers to cause a denial of service via unknown vectors.
Published 2011-08-01 · Modified
7.8EPSS 0.045
CVE-2014-5160
Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. NOTE: the vendor reportedly asserts that this behavior is "by design.
Published 2014-08-01 · Modified
6.4EPSS 0.348
CVE-2017-5809
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Published 2018-02-15 · Modified
5.5EPSS 0.016