CVE-2016-10730

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API script. It should not be run by users directly. It uses star to backup and restore data. It runs binaries with root permissions when parsing the command line argument --star-path.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-107319.8ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the requ CVE-2016-107329.8ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or proc CVE-2016-107339.8ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-107349.8ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.CVE-2016-107356.1In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2016-107366.1The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_CVE-2016-107375.4Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.CVE-2016-107388.8Zenbership v107 has CSRF via admin/cp-functions/event-add.php.CVE-2016-107395.3In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 ad CVE-2016-10749.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin CVE-2016-107404.9Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of confi CVE-2016-107414.7In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race c