7 CVEs matched to Druva by name in NVD, none on CISA's Known Exploited list.
Back to the Druva profile · Alternatives to Druva · CVE RSS feed
1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbit…
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM…
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2022 | 0 | 3 | 0 | 0 | 0 | 3 |
| 2020 | 0 | 4 | 0 | 0 | 0 | 4 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2020-5752 | 8.6% | 95% |
| CVE-2019-3999 | 8.6% | 95% |
| CVE-2021-36667 | 2.7% | 86% |
| CVE-2019-4000 | 0.7% | 54% |
| CVE-2019-4001 | 0.6% | 46% |
| CVE-2021-36665 | 0.5% | 42% |
| CVE-2021-36666 | 0.5% | 38% |
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.s…
An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission.
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitr…
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon.
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privile…
Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYST…