CVE-2016-10729

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.

• CWE-77

• https://www.exploit-db.com/exploits/39217/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/39217/Exploit, Third Party Advisory, VDB Entry

Published

Oct 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10723An issue was discovered in the Linux kernel through 4.17.2. …
• CVE-2016-10724Bitcoin Core before v0.13.0 allows denial of service (memory…
• CVE-2016-10725In Bitcoin Core before v0.13.0, a non-final alert is able to…
• CVE-2016-10726The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and …
• CVE-2016-10727camel/providers/imapx/camel-imapx-server.c in the IMAPx comp…
• CVE-2016-10728An issue was discovered in Suricata before 3.1.2. If an ICMP…
• CVE-2016-1073Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat…
• CVE-2016-10730An issue was discovered in Amanda 3.3.1. A user with backup …
• CVE-2016-10731ProjectSend (formerly cFTP) r582 allows SQL injection via ma…
• CVE-2016-10732ProjectSend (formerly cFTP) r582 allows authentication bypas…
• CVE-2016-10733ProjectSend (formerly cFTP) r582 allows directory traversal …
• CVE-2016-10734ProjectSend (formerly cFTP) r582 allows Insecure Direct Obje…