CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

PT-2026-65307

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...

CVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2021-32085

Summary (CVE-2021-32085): Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is affected by a credential-related issue where default user credentials are installed with a known MySQL password (box747) for the report and R1 accounts. This enables remote attackers to gain privileged access to t...

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...

PT-2026-65306

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

PT-2026-65310

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

The CVE concerns the Veeam Updater component within the Veeam Software Appliance. It describes a local privilege escalation that could allow a local user to gain root-level access on the underlying OS. The connected documents confirm the affected component and the impact (elevated privileges to r...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

EUVD-2026-47595

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

PT-2026-63274

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

EUVD-2026-46358

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64877

CVE-2026-64877 is an authenticated, non-admin SQL injection vulnerability in the appliance’s ticketing REST API that can lead to access to sensitive data stored in the appliance database. The CVSS v3.1 base score is 9.6 (CRITICAL) with network attack vector, low attack complexity, and privileges ...

PT-2026-62039

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. SQL injecti...

Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plugins and that has been available in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code wi...