14 matches found
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...
CVE-2021-32085
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...
CVE-2021-32085
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...
CVE-2021-32087
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...
CVE-2021-32087
The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to the use of hard-coded credentials . The software installs with a default kbftp account using the publicly known password getbxf . This oversight allows remote attackers to gain privileged access to the FTP service interfa...
CVE-2021-32085
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...
CVE-2021-32084
The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to an improper access control issue where API endpoints are not restricted even if the web console is limited by IP address or subnets. If an attacker obtains valid credentials or API keys , they can bypass these network res...
CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The list of vulnerabilities is as...
Quest KACE SMA 13.0.x < 13.0.385 / 13.1.x < 13.1.81 / 13.2.x < 13.2.183 / 14.0.x < 14.0.341 / 14.1.x < 14.1.101 Multiple Vulnerabilities
The version of Quest KACE Systems Management Appliance SMA running on the remote host is 13.0.x prior to 13.0.385, 13.1.x prior to 13.1.81, 13.2.x prior to 13.2.183, 14.0.x prior to 14.0.341, or 14.1.x prior to 14.1.101. It is, therefore, affected by multiple vulnerabilities, including: - An...
Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems
Threat actors are suspected to be exploiting a maximum-severity security flaw impacting Quest KACE Systems Management Appliance SMA, according to Arctic Wolf. The cybersecurity company said it observed malicious activity starting the week of March 9, 2026, in customer environments that's consiste...
CVE-2022-38220
An XSS vulnerability exists within Quest KACE Systems Management Appliance SMA through 12.1 that may allow remote injection of arbitrary web script or HTML...
CVE-2022-29807
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance SMA through 12.0 that can allow for remote code execution via downloadagentinstaller.php...