Symantec Backup Exec vulnerabilities

5 CVEs affecting Symantec Backup Exec, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-4678, published 2013-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4676, published 2013-08-05. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors…
CVE-2011-0546, published 2011-05-31. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allows man-in-the-middle attackers to execute…
CVE-2013-4575, published 2013-08-05. High severity, CVSS 7.9. EPSS: 1.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service (agent…
CVE-2013-4678, published 2013-08-05. Low severity, CVSS 2.7. EPSS: 0.5% chance of exploitation in the next 30 days. The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to obtain sensitive host-version information via unspecified…
CVE-2013-4677, published 2013-08-05. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions (Everyone: Read and Everyone: Change) for backup data files, which allows local users to obtain sensitive…