CVE-2018-11179

The CVE-2018-11179 entry concerns Quest DR Series Disk Backup software prior to 4.0.3.1, which, along with related CVEs in the CORE-2018-0002 advisory, contains multiple command-injection vulnerabilities in the DR Series appliances. Affected product: Quest DR Series Disk Backup Software (multiple...

CVE-2018-11188

CVE-2018-11188 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 documents multiple command-injection vulnerabilities in the DR Series appliances (e.g., unauthenticated and authenticated JSON-RPC/API calls) that could allow remote code execution with root priv...

CVE-2018-11186

CVE-2018-11186 relates to Quest DR Series Disk Backup appliances (versions before 4.0.3.1) with multiple command-injection vulnerabilities. The CoreLabs advisory details remote code execution vectors via the DR series web interface and JSON-RPC, including unauthenticated and authenticated injecti...

CVE-2018-11151

Concrete details found: CVE-2018-11151 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection issue in the DR series web/JSON-RPC interface, notably via setResetOptions (admin_email/relay_host) and related RPC methods (e.g., login, update, add, joi...

CVE-2018-11167

CVE-2018-11167 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling command injection through the appliance web interface/JSON-RPC paths. Core documentation shows a family of related command-injection vulnerabilities (e.g., unauthenticated login and authenticated actions) that ...

CVE-2018-11174

Quest DR Series Disk Backup Software 4.0.3 prior to 4.0.3.1 is affected by multiple command-injection vulnerabilities in its DR appliances’ JSON-RPC/web interfaces. The Core Security advisory enumerates numerous CVEs (e.g., CVE-2018-11143 through CVE-2018-11179 and related variants) that allow re...

CVE-2018-11182

CVE-2018-11182 affects Quest DR Series Disk Backup Software (before 4.0.3.1). Core Security CORE-2018-0002 documents multiple command-injection vulnerabilities in the DR Series appliances via the JSON-RPC web interface, allowing remote command execution and, in some vectors, privilege escalation....

CVE-2018-11189

CVE-2018-11189 applies to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities in the web UI allow an attacker with/without authentication to execute arbitrary commands as root via various API methods. CoreLabs details show a progression of CVEs ...

CVE-2018-11169

CVE-2018-11169 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 details multiple command-injection vulnerabilities in the DR appliance’s web interface/JSON-RPC API across various components (e.g., login, user update/delete, password updates, container/storage...

CVE-2018-11172

CVE-2018-11172 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified in the DR Series appliances’ web/JSON-RPC interfaces. The CoreLabs advisory details unauthenticated and authenticated vectors that allow remote execut...

CVE-2018-11192

Summary of findings (CVE-2018-11192 family) : The Quest DR Series Disk Backup Appliances (hardware/software) release prior to 4.0.3.1 contain multiple command-injection vulnerabilities in the DR Series web/JSON-RPC interfaces. The CoreLabs CORE-2018-0002 advisory documents a range of CVEs (e.g., ...

CVE-2018-11157

CVE-2018-11157 affects Quest DR Series Disk Backup Software (v4.0.3.1 and earlier). CoreLabs/Core advisory details a command-injection vulnerability in the DR appliance Web/JSON-RPC API, specifically the join domain functionality via the ActiveDirectoryService module where the domain parameter ca...

CVE-2018-11190

The CORE advisory details remote command injection and privilege escalation flaws in Quest DR Series Disk Backup Software prior to build 4.0.3.1. Exploitation occurs via the DR Series web UI/JSON-RPC methods (e.g., Logon, update, add, set, delete, etc.), allowing authenticated or unauthenticated ...

CVE-2018-11173

CVE-2018-11173 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, with multiple command-injection flaws exposed via the web interface and JSON-RPC API. CoreLabs advisory CORE-2018-0002 documents a family of related vulnerabilities (CVE-2018-11143 through CVE-2018-11194) enabling remo...

CVE-2018-11178

CVE-2018-11178 is part of a set of related command-injection vulnerabilities in Quest DR Series Disk Backup appliances (Quest DR Series Disk Backup Software) affecting versions up to 4.0.3.1. The CoreLabs CORE-2018-0002 advisory and subsequent materials describe multiple CVEs (e.g., CVE-2018-1114...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11176

Quest DR Series Disk Backup Software vulnerable to command injection via DREncryption::set_passphrase (CVE-2018-11176). Proof-of-concept shows attacker can inject commands through the passphrase parameter, enabling arbitrary code execution with the appliance’s privileges. The CoreLabs advisory CO...

CVE-2018-11144

The connected CORE advisory CORE-2018-0002 documents multiple command-injection vulnerabilities in Quest DR Series Disk Backup appliances running versions prior to 4.0.3.1. The issues affect the DR Series web interfaces and JSON-RPC endpoints, enabling remote command execution (unauthenticated in...

CVE-2018-11147

CVE-2018-11147 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities exist in the web interface/JSON‑RPC API. Public-advisory text identifies a primary unauthenticated remote code-execution vector (section 7.1) that could allow an atta...

CVE-2018-11165

CVE-2018-11165 pertains to Quest DR Series Disk Backup Software before 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliances’ JSON-RPC/Web interfaces. The Core advisory details unauthenticated and authenticated vectors (e.g., CVE-2018-11143 through CVE...