CVE-2024-28222

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-282246.6Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauth CVE-2024-282267.5in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input.CVE-2024-282285.3In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible CVE-2024-282296.5In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles CVE-2024-28234.3A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/m CVE-2024-282306.5In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions CVE-2024-282317.5eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0 CVE-2024-282327.5Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the user CVE-2024-282336.1JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker c CVE-2024-282344.7Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inj CVE-2024-282356.5Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for bro CVE-2024-282366.5Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable subst