Druva provides client-side backup and data-protection software, with its exposure concentrated in the InSync product line. The recurring vulnerability pattern reflects challenges in secure code execution and input handling: OS command injection, deserialization of untrusted data, code injection, input validation, and path traversal all recur across the vendor's offerings, indicating structural gaps in boundary validation between user input and system operations. Druva's disclosure history shows a tendency toward public exploit availability for these classes. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Druva over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3999HIGH Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating syste | Feb 25, 2020 | 7.8 | 47 | NO | YES |
CVE-2020-5752HIGH Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges. | May 21, 2020 | 7.8 | 41 | NO | YES |
CVE-2021-36667HIGH Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized cal | Jul 12, 2022 | 7.8 | 28 | NO | NO |
CVE-2021-36668HIGH URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
CVE-2021-36666HIGH An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
CVE-2021-36665HIGH An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. | Jul 12, 2022 | 7.8 | 27 | NO | NO |
CVE-2019-4000HIGH Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressio | Feb 25, 2020 | 7.8 | 26 | NO | NO |
CVE-2019-4001HIGH Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code. | Mar 24, 2020 | 7.8 | 24 | NO | NO |
CVE-2020-5798HIGH inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks | Dec 7, 2020 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Druva.
Media articles that mention a CVE ID that affects a product developed by Druva — matched by CVE ID, not by vendor name.