8267 matches found
CVE-2018-11153
The CVE-2018-11153 entry concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliance’s JSON-RPC/Web UI surface. The CoreLabs CORE advisory details unauthenticated and authenticated command-injection vecto...
CVE-2018-11166
Summary (supported by provided documents): Quest DR Series Disk Backup Software, versions prior to 4.0.3.1, contains multiple command-injection vulnerabilities (CVE-2018-11143 through CVE-2018-11194) in its DR appliance web/JSON-RPC interfaces. The CoreLabs advisory CORE-2018-0002 details numerou...
CVE-2018-11184
CVE-2018-11184 affects Quest DR Series Disk Backup Software up to build 4.0.3.1, where the UsageService’s get usage operation can be abused to inject commands via the type parameter (as shown in the 7.42 example). The vulnerability arises from unsanitized user input used to construct a command li...
CVE-2018-11149
CVE-2018-11149 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs/Core advisory CORE-2018-0002 documents a command-injection vulnerability in the DR Series DRCleaner/setCleaner routine, enabling an attacker to inject shell commands via crafted input in the appliance’s web/API...
CVE-2018-11146
Affected product: Quest DR Series Disk Backup Software. Vulnerabilities allow remote command execution via several web/API entry points; notably, command injection in update_pw and setAdminPassword. Versions prior to 4.0.3.1 are implicated. Build 4.0.3.1 reportedly fixes these issues. If upgradin...
CVE-2018-11180
CVE-2018-11180 is a vulnerability in the Quest DR Series CloudPortal registration path where the registrationCode parameter is unsafely used to build a command line. The CoreLabs advisory and PoC details show an attacker can trigger remote command execution by crafting the registrationCode in a r...
CVE-2018-11193
CVE-2018-11193 is a privilege-escalation flaw in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory details multiple command-injection paths in the DR Series Web UI (JSON-RPC) enabling an attacker with web access to reach root via webadmin privileges (e.g., ocashell, env...
CVE-2018-11162
CVE-2018-11162 corresponds to a command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory documents a remote, authenticated issue in DRStorageGroup.update where unsanitized input in newGroup (e.g., Name, Compression_mode) is used to build a co...
CVE-2018-11183
Quest DR Series Disk Backup Software before 4.0.3.1 contains multiple command-injection vulnerabilities in its JSON-RPC interface, enabling remote code execution (including unauthenticated login) via numerous endpoints. The CoreLabs CORE-2018-0002 advisory details extensive CVEs (e.g., CVE-2018-1...
CVE-2018-11175
CVE-2018-11175 and related CVEs describe multiple remote command injection flaws in Quest DR Series Disk Backup Appliances prior to 4.0.3.1. Core Security/CoreLabs and CNVD/NVD entries confirm affected components include the web UI and JSON-RPC endpoints, enabling attackers to execute arbitrary c...
CVE-2018-11194
Summary: CVE-2018-11194 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling privilege escalation. The related CORE advisory CORE-2018-0002 details multiple command-injection and privilege-escalation vectors on DR Series appliances, describing root-level access via web interfac...
CVE-2018-11148
The provided documents confirm a set of command-injection vulnerabilities in Quest DR Series Disk Backup Software running older than 4.0.3.1. Specifically, the CoreLabs CORE-2018-0002 advisory details multiple CVEs (notably CVE-2018-11143 through CVE-2018-11179 variants) that allow remote code ex...
CVE-2018-11191
CVE-2018-11191 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs describes multiple privilege-escalation vectors resulting from the DR appliance web interface and related components: attackers who gain access can escalate from the webserver user (webadmin) to root via local ...
CVE-2018-11152
CVE-2018-11152 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection in the JSON-RPC API (set_compression) where the compressionLevel parameter is unsafely used to build a shell command, enabling remote execution. Affected product: Quest DR Series...
CVE-2018-11158
The CVE-2018-11158 entry concerns Quest DR Series Disk Backup Software. CoreSecurity’s CORE-2018-0002 and related materials describe multiple command-injection vulnerabilities in DR Series appliances (versions prior to 4.0.3.1) with both unauthenticated and authenticated vectors via the web UI an...
CVE-2018-11188
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 46 of 46...
CVE-2018-11161
CVE-2018-11161 is a real command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. Connected sources (NVD, CNVD, CoreLabs CORE-2018-0002) describe multiple CVEs in the DR Series family, with CVE-2018-11161 specifically noting that the StorageGroupService deletion p...
CVE-2018-11166
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...