Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 35 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 31 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 21 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 23 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 5 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 4 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 30 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 10 of 46...

CVE-2018-11191

CVE-2018-11191 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs describes multiple privilege-escalation vectors resulting from the DR appliance web interface and related components: attackers who gain access can escalate from the webserver user (webadmin) to root via local ...

CVE-2018-11176

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 34 of 46...

CVE-2018-11153

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 11 of 46...

CVE-2018-11184

CVE-2018-11184 affects Quest DR Series Disk Backup Software up to build 4.0.3.1, where the UsageService’s get usage operation can be abused to inject commands via the type parameter (as shown in the 7.42 example). The vulnerability arises from unsanitized user input used to construct a command li...

CVE-2018-11156

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 14 of 46...

CVE-2018-11146

Affected product: Quest DR Series Disk Backup Software. Vulnerabilities allow remote command execution via several web/API entry points; notably, command injection in update_pw and setAdminPassword. Versions prior to 4.0.3.1 are implicated. Build 4.0.3.1 reportedly fixes these issues. If upgradin...

CVE-2018-11152

CVE-2018-11152 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection in the JSON-RPC API (set_compression) where the compressionLevel parameter is unsafely used to build a shell command, enabling remote execution. Affected product: Quest DR Series...

CVE-2018-11188

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 46 of 46...

CVE-2018-11169

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 27 of 46...

CVE-2018-11194

Summary: CVE-2018-11194 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling privilege escalation. The related CORE advisory CORE-2018-0002 details multiple command-injection and privilege-escalation vectors on DR Series appliances, describing root-level access via web interfac...

CVE-2018-11153

The CVE-2018-11153 entry concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliance’s JSON-RPC/Web UI surface. The CoreLabs CORE advisory details unauthenticated and authenticated command-injection vecto...