Veritas NetBackup Appliance vulnerabilities

In Veritas NetBackup Appliance version 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.

In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

In Veritas NetBackup Appliance before version 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.