CVE-2017-17659

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4906.

• CWE-89
• CWE-89

• https://zerodayinitiative.com/advisories/ZDI-17-995Third Party Advisory, VDB Entry
• https://zerodayinitiative.com/advisories/ZDI-17-995Third Party Advisory, VDB Entry

Published

Feb 8, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17653This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17654This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17655This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17656This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17657This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17658This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-1766Due to incorrect authorization in IBM Business Process Manag…4.3
• CVE-2017-17662Directory traversal in the HTTP server on Yawcam 0.2.6 throu…
• CVE-2017-17663The htpasswd implementation of mini_httpd before v1.28 and o…
• CVE-2017-17664A Remote Crash issue was discovered in Asterisk Open Source …
• CVE-2017-17665In Octopus Deploy before 4.1.3, the machine update process d…
• CVE-2017-17668Memory write mechanism in NCR S1 Dispenser controller before…