CVE-2018-11191

CVE-2018-11191 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs describes multiple privilege-escalation vectors resulting from the DR appliance web interface and related components: attackers who gain access can escalate from the webserver user (webadmin) to root via local ...

CVE-2018-11160

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 18 of 46...

CVE-2018-11192

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 4 of 6...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11167

CVE-2018-11167 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling command injection through the appliance web interface/JSON-RPC paths. Core documentation shows a family of related command-injection vulnerabilities (e.g., unauthenticated login and authenticated actions) that ...

CVE-2018-11185

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 43 of 46...

CVE-2018-11169

CVE-2018-11169 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 details multiple command-injection vulnerabilities in the DR appliance’s web interface/JSON-RPC API across various components (e.g., login, user update/delete, password updates, container/storage...

CVE-2018-11177

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 35 of 46...

CVE-2018-11180

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 38 of 46...

CVE-2018-11152

CVE-2018-11152 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection in the JSON-RPC API (set_compression) where the compressionLevel parameter is unsafely used to build a shell command, enabling remote execution. Affected product: Quest DR Series...

CVE-2018-11152

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 10 of 46...

CVE-2018-11170

CVE-2018-11170 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1. The concern is a broader set of command-injection vulnerabilities found in the Core Security CORE-2018-0002 advisory, affecting multiple CVEs (e.g., CVE-2018-11143 to CVE-2018-11194) via the JSON-RPC/web interfaces. Th...

CVE-2018-11181

Quest DR Series Disk Backup appliances running versions before 4.0.3.1 are affected by multiple command injection vulnerabilities in the web/JSON‑RPC interfaces (e.g., unauthenticated Logon and various authenticated endpoints), enabling remote code execution with root privileges on vulnerable dev...

CVE-2018-11192

Summary of findings (CVE-2018-11192 family) : The Quest DR Series Disk Backup Appliances (hardware/software) release prior to 4.0.3.1 contain multiple command-injection vulnerabilities in the DR Series web/JSON-RPC interfaces. The CoreLabs CORE-2018-0002 advisory documents a range of CVEs (e.g., ...

CVE-2018-11172

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 30 of 46...

CVE-2018-11175

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 33 of 46...

CVE-2018-11144

The connected CORE advisory CORE-2018-0002 documents multiple command-injection vulnerabilities in Quest DR Series Disk Backup appliances running versions prior to 4.0.3.1. The issues affect the DR Series web interfaces and JSON-RPC endpoints, enabling remote command execution (unauthenticated in...

CVE-2018-11144

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 2 of 46...

CVE-2018-11172

CVE-2018-11172 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified in the DR Series appliances’ web/JSON-RPC interfaces. The CoreLabs advisory details unauthenticated and authenticated vectors that allow remote execut...

CVE-2018-11147

CVE-2018-11147 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities exist in the web interface/JSON‑RPC API. Public-advisory text identifies a primary unauthenticated remote code-execution vector (section 7.1) that could allow an atta...