CVE-2018-6328

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

• CWE-287

• https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
• https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry
• https://support.unitrends.com/UnitrendsBackup/s/article/000001150Vendor Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/000006002Vendor Advisory
• https://www.exploit-db.com/exploits/44297/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/45559/Exploit, Third Party Advisory, VDB Entry

Published

Mar 14, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6319In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a spe…
• CVE-2018-6320A vulnerability has been discovered in login.cgi in Pulse Se…
• CVE-2018-6321Unquoted Windows search path vulnerability in the panda_url_…
• CVE-2018-6322Panda Global Protection 17.0.1 allows local users to gain pr…
• CVE-2018-6323The elf_object_p function in elfcode.h in the Binary File De…
• CVE-2018-6324F-Secure Radar (on-premises) before 2018-02-15 has an Unvali…
• CVE-2018-6329It was discovered that the Unitrends Backup (UB) before 10.1…
• CVE-2018-6330Laravel 5.4.15 is vulnerable to Error based SQL injection in…
• CVE-2018-6331Buck parser-cache command loads/saves state using Java seria…9.8
• CVE-2018-6332A potential denial-of-service issue in the Proxygen handling…5.9
• CVE-2018-6333The hhvm-attach deep link handler in Nuclide did not properl…9.8
• CVE-2018-6334Multipart-file uploads call variables to be improperly regis…9.8