CVE-2018-11178

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 36 of 46...

CVE-2018-11185

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 43 of 46...

CVE-2018-11181

Quest DR Series Disk Backup appliances running versions before 4.0.3.1 are affected by multiple command injection vulnerabilities in the web/JSON‑RPC interfaces (e.g., unauthenticated Logon and various authenticated endpoints), enabling remote code execution with root privileges on vulnerable dev...

CVE-2018-11185

CVE-2018-11185 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple input vectors in the web interface/JSON‑RPC allow command execution. The CoreLabs Core Advisory details a wide set of command‑injection flaws (e.g., unauthenticated and authenticated paths) across num...

CVE-2018-11160

CVE-2018-11160 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 describes multiple command-injection vulnerabilities in the DR appliance web/API interfaces, notably in the DRStorageGroup creation path, where inputs such as the group name can be used to constr...

CVE-2018-11147

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 5 of 46...

CVE-2018-11157

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 15 of 46...

CVE-2018-11145

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 3 of 46...

CVE-2018-11190

The CORE advisory details remote command injection and privilege escalation flaws in Quest DR Series Disk Backup Software prior to build 4.0.3.1. Exploitation occurs via the DR Series web UI/JSON-RPC methods (e.g., Logon, update, add, set, delete, etc.), allowing authenticated or unauthenticated ...

CVE-2018-11186

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 44 of 46...

CVE-2018-11157

CVE-2018-11157 affects Quest DR Series Disk Backup Software (v4.0.3.1 and earlier). CoreLabs/Core advisory details a command-injection vulnerability in the DR appliance Web/JSON-RPC API, specifically the join domain functionality via the ActiveDirectoryService module where the domain parameter ca...

CVE-2018-11159

CVE-2018-11159 (Quest DR Series Disk Backup) Product: Quest DR Series Disk Backup Software (appliances) prior to version 4.0.3.1. Issue: In the JSON-RPC API, the get_storage_group_statistics call accepts a parameter named group that is not sanitized, enabling an attacker to inject system commands...

CVE-2018-11154

CVE-2018-11154 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The CNVD/NVD entries describe multiple command-injection flaws in the DR Series web/API interfaces (registerDR2000v and related license/registration methods) that allow an attacker to inject commands through various inp...

CVE-2018-11165

CVE-2018-11165 pertains to Quest DR Series Disk Backup Software before 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliances’ JSON-RPC/Web interfaces. The Core advisory details unauthenticated and authenticated vectors (e.g., CVE-2018-11143 through CVE...

CVE-2018-11167

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

CVE-2018-11167

CVE-2018-11167 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling command injection through the appliance web interface/JSON-RPC paths. Core documentation shows a family of related command-injection vulnerabilities (e.g., unauthenticated login and authenticated actions) that ...

CVE-2018-11163

Quest DR Series Disk Backup Software before 4.0.3.1 is affected by multiple command‑injection vulnerabilities in the DR Series appliances’ web/JSON‑RPC interface. Public details document a range of CVEs (including CVE-2018-11143 to CVE-2018-11194) that allow remote or authenticated attackers to i...

CVE-2018-11163

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 21 of 46...

CVE-2018-11147

CVE-2018-11147 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities exist in the web interface/JSON‑RPC API. Public-advisory text identifies a primary unauthenticated remote code-execution vector (section 7.1) that could allow an atta...

CVE-2018-11144

The connected CORE advisory CORE-2018-0002 documents multiple command-injection vulnerabilities in Quest DR Series Disk Backup appliances running versions prior to 4.0.3.1. The issues affect the DR Series web interfaces and JSON-RPC endpoints, enabling remote command execution (unauthenticated in...