CVE-2018-11194

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 6 of 6...

CVE-2018-11150

CVE-2018-11150 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Core Security advisory documents multiple command-injection vulnerabilities in the DR appliances, with CVE-2018-11150 specifically described as a remote command-injection flaw in the replication scheduling subsystem...

CVE-2018-11143

Summary of available details: Quest DR Series Disk Backup Software prior to version 4.0.3.1 contains multiple command-injection vulnerabilities exposed via its web/JSON-RPC API. The most critical issue, CVE-2018-11143, allows unauthenticated remote command execution through the Logon endpoint, wi...

CVE-2018-11162

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 20 of 46...

CVE-2018-11183

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

CVE-2018-11160

CVE-2018-11160 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 describes multiple command-injection vulnerabilities in the DR appliance web/API interfaces, notably in the DRStorageGroup creation path, where inputs such as the group name can be used to constr...

CVE-2018-11171

CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...

CVE-2018-11150

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 8 of 46...

CVE-2018-11153

The CVE-2018-11153 entry concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliance’s JSON-RPC/Web UI surface. The CoreLabs CORE advisory details unauthenticated and authenticated command-injection vecto...

CVE-2018-11171

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 29 of 46...

CVE-2018-11166

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...

CVE-2018-11168

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 26 of 46...

CVE-2018-11182

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 40 of 46...

CVE-2018-11145

CVE-2018-11145 affects Quest DR Series Disk Backup Software 4.x prior to 4.0.3.1, enabling command injection via exposed web/JSON‑RPC interfaces. CORE CORE-2018-0002 details multiple command‑injection vectors across DRSeries RPC methods, including login, user management, container/storage actions...

CVE-2018-11147

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 5 of 46...

CVE-2018-11149

CVE-2018-11149 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs/Core advisory CORE-2018-0002 documents a command-injection vulnerability in the DR Series DRCleaner/setCleaner routine, enabling an attacker to inject shell commands via crafted input in the appliance’s web/API...

CVE-2018-11178

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 36 of 46...

CVE-2018-11176

Quest DR Series Disk Backup Software vulnerable to command injection via DREncryption::set_passphrase (CVE-2018-11176). Proof-of-concept shows attacker can inject commands through the passphrase parameter, enabling arbitrary code execution with the appliance’s privileges. The CoreLabs advisory CO...

CVE-2018-11188

CVE-2018-11188 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 documents multiple command-injection vulnerabilities in the DR Series appliances (e.g., unauthenticated and authenticated JSON-RPC/API calls) that could allow remote code execution with root priv...

CVE-2018-11190

The CORE advisory details remote command injection and privilege escalation flaws in Quest DR Series Disk Backup Software prior to build 4.0.3.1. Exploitation occurs via the DR Series web UI/JSON-RPC methods (e.g., Logon, update, add, set, delete, etc.), allowing authenticated or unauthenticated ...