CVE-2016-7399

scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

• CWE-77

• http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-executionThird Party Advisory
• http://www.securityfocus.com/bid/94384Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037555
• https://www.veritas.com/content/support/en_US/security/VTS16-002.htmlVendor Advisory
• https://www.veritas.com/support/en_US/article.000116055Mitigation, Patch, Vendor Advisory
• http://www.sec-1.com/blog/2016/veritas-netbackup-appliance-unauthenticated-remote-command-executionThird Party Advisory
• http://www.securityfocus.com/bid/94384Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037555
• https://www.veritas.com/content/support/en_US/security/VTS16-002.htmlVendor Advisory
• https://www.veritas.com/support/en_US/article.000116055Mitigation, Patch, Vendor Advisory

Published

Jan 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7392Heap-based buffer overflow in the pstoedit_suffix_table_init…
• CVE-2016-7393Stack-based buffer overflow in the aac_sync function in aac_…
• CVE-2016-7394tiki wiki cms groupware <=15.2 has a xss vulnerability, allo…
• CVE-2016-7395SkPath.cpp in Skia, as used in Google Chrome before 53.0.278…
• CVE-2016-7397The Frontend component in Sophos UTM with firmware 9.405-5 a…
• CVE-2016-7398A type confusion vulnerability in the merge_param() function…9.8
• CVE-2016-7400Multiple SQL injection vulnerabilities in Exponent CMS befor…
• CVE-2016-7401The cookie parsing code in Django before 1.8.15 and 1.9.x be…
• CVE-2016-7402SAP ASE 16.0 SP02 PL03 and prior versions allow attackers wh…
• CVE-2016-7404OpenStack Magnum passes OpenStack credentials into the Heat …
• CVE-2016-7405The qstr method in the PDO driver in the ADOdb Library for P…
• CVE-2016-7406Format string vulnerability in Dropbear SSH before 2016.74 a…