CVE-2018-11192

Summary of findings (CVE-2018-11192 family) : The Quest DR Series Disk Backup Appliances (hardware/software) release prior to 4.0.3.1 contain multiple command-injection vulnerabilities in the DR Series web/JSON-RPC interfaces. The CoreLabs CORE-2018-0002 advisory documents a range of CVEs (e.g., ...

CVE-2018-11189

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 1 of 6...

CVE-2018-11190

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 2 of 6...

CVE-2018-11189

CVE-2018-11189 applies to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities in the web UI allow an attacker with/without authentication to execute arbitrary commands as root via various API methods. CoreLabs details show a progression of CVEs ...

CVE-2018-11149

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 7 of 46...

CVE-2018-11151

Concrete details found: CVE-2018-11151 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection issue in the DR series web/JSON-RPC interface, notably via setResetOptions (admin_email/relay_host) and related RPC methods (e.g., login, update, add, joi...

CVE-2018-11157

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 15 of 46...

CVE-2018-11143

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 1 of 46...

CVE-2018-11145

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 3 of 46...

CVE-2018-11175

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 33 of 46...

CVE-2018-11174

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 32 of 46...

CVE-2018-11173

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 31 of 46...

CVE-2018-11163

Quest DR Series Disk Backup Software before 4.0.3.1 is affected by multiple command‑injection vulnerabilities in the DR Series appliances’ web/JSON‑RPC interface. Public details document a range of CVEs (including CVE-2018-11143 to CVE-2018-11194) that allow remote or authenticated attackers to i...

CVE-2018-11167

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11176

Quest DR Series Disk Backup Software vulnerable to command injection via DREncryption::set_passphrase (CVE-2018-11176). Proof-of-concept shows attacker can inject commands through the passphrase parameter, enabling arbitrary code execution with the appliance’s privileges. The CoreLabs advisory CO...

CVE-2018-11180

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 38 of 46...

CVE-2018-11163

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 21 of 46...

CVE-2018-11144

The connected CORE advisory CORE-2018-0002 documents multiple command-injection vulnerabilities in Quest DR Series Disk Backup appliances running versions prior to 4.0.3.1. The issues affect the DR Series web interfaces and JSON-RPC endpoints, enabling remote command execution (unauthenticated in...

CVE-2018-11147

CVE-2018-11147 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities exist in the web interface/JSON‑RPC API. Public-advisory text identifies a primary unauthenticated remote code-execution vector (section 7.1) that could allow an atta...