CVE-2018-11171

CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...

CVE-2018-11164

CVE-2018-11164 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. Core/ENISA/public docs detail multiple command-injection vulnerabilities exposed via the web UI/JSON-RPC API, enabling remote code execution (some vectors unauthenticated, others requiring an auth token). The flaws aris...

CVE-2018-11192

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 4 of 6...

CVE-2018-11193

CVE-2018-11193 is a privilege-escalation flaw in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory details multiple command-injection paths in the DR Series Web UI (JSON-RPC) enabling an attacker with web access to reach root via webadmin privileges (e.g., ocashell, env...

CVE-2018-11193

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 5 of 6...

CVE-2018-11194

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 6 of 6...

CVE-2018-11184

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 42 of 46...

CVE-2018-11183

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

CVE-2018-11170

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 28 of 46...

CVE-2018-11166

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...

CVE-2018-11165

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 23 of 46...

CVE-2018-11164

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 22 of 46...

CVE-2018-11171

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 29 of 46...

CVE-2018-11152

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 10 of 46...

CVE-2018-11150

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 8 of 46...

CVE-2018-11154

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 12 of 46...

CVE-2018-11161

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 19 of 46...

CVE-2018-11149

CVE-2018-11149 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs/Core advisory CORE-2018-0002 documents a command-injection vulnerability in the DR Series DRCleaner/setCleaner routine, enabling an attacker to inject shell commands via crafted input in the appliance’s web/API...

CVE-2018-11180

CVE-2018-11180 is a vulnerability in the Quest DR Series CloudPortal registration path where the registrationCode parameter is unsafely used to build a command line. The CoreLabs advisory and PoC details show an attacker can trigger remote command execution by crafting the registrationCode in a r...

CVE-2018-11162

CVE-2018-11162 corresponds to a command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory documents a remote, authenticated issue in DRStorageGroup.update where unsanitized input in newGroup (e.g., Name, Compression_mode) is used to build a co...