CVE-2022-36954

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1Vendor Advisory

Timeline

Published: Jul 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-369558.4In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileg CVE-2022-369567.5In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBac CVE-2022-369577.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-369588.8SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access CVE-2022-36967.2A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.CVE-2022-369608.8SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWin CVE-2022-369618.8A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escala CVE-2022-369627.2SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarW CVE-2022-369637.2The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid So CVE-2022-369648.8SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access CVE-2022-369656.1Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and re CVE-2022-369665.4Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct