Sql injection

The 'orgID' parameter received by the '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, a blind time-based type...

Design/Logic Flaw

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

Cross site scripting

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...

Authorization

The 'systemui/settingsnetwork.php' and 'systemui/settingspatching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'XForwardedFor' HTTP headers in a POST request. An anonymous user c...

CVE-2018-11135

The script '/adminui/errordetails.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks...

CVE-2018-11136

The 'orgID' parameter received by the '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, a blind time-based type...

CVE-2018-11140

The 'reportID' parameter received by the '/common/runreport.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, an error-based type...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

CVE-2018-11139

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...

CVE-2018-11133

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...

CVE-2018-11132

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

CVE-2018-11137

CVE-2018-11137 affects Quest KACE System Management Appliance 8.0 (Build 8.0.318). The vulnerability is a directory-traversal flaw in the /common/download_attachment.php script, where the checksum parameter can be crafted to read arbitrary files with www privileges (no administrator privileges re...

CVE-2018-11135

CVE-2018-11135 concerns the Quest KACE System Management Appliance 8.0.318. An authenticated user can trigger a deserialization-based PHP object injection in the script /adminui/error_details.php, enabling arbitrary PHP object execution as described in the vulnerability notes. Core Security CORE-...

CVE-2018-11136

CVE-2018-11136 affects Quest KACE System Management Appliance 8.0 (Build 8.0.318). The orgID parameter in /common/download_agent_installer.php is not sanitized, enabling unauthenticated SQL injection (blind time-based). Proof-of-concept demonstrated time delays; Core/CORE advisory and other sourc...

CVE-2018-11141

CVE-2018-11141 affects Quest KACE System Management Virtual Appliance 8.0.318. The vulnerability is a path traversal issue in the advisory/authored UI where the IMAGES_JSON and attachments_to_remove[] parameters can cause arbitrary file write and delete operations. Proof-of-concept details in the...

CVE-2018-11134

CVE-2018-11134 affects Quest KACE System Management Appliance 8.0 (Build 8.0.318). The issue is a privilege-escalation vector in the Sudo Server component: a command available to the web server user could change other users’ passwords, including the kace_support account, which has full sudo privi...

CVE-2018-11142

CVE-2018-11142 affects Quest KACE System Management Appliance 8.0.318. The vulnerability is in the web console: systemui/settings_network.php and systemui/settings_patching.php are accessible only from localhost, and an attacker can bypass this restriction by tampering with Host and X_Forwarded_F...

CVE-2018-11133

CVE-2018-11133 affects Quest KACE System Management Appliance 8.0.318. The vulnerability is a cross-site scripting flaw in the fmt parameter of /common/run_cross_report.php, enabling arbitrary JavaScript in users’ browsers (CWE-79). The issue is documented in multiple sources (NVD/Nucli, CIRCL, C...

CVE-2018-11133

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...