CVE-2018-11168

Summary: CVE-2018-11168 affects Quest DR Series Disk Backup software prior to 4.0.3.1 and is part of a broader set of command‑injection vulnerabilities in DR Series appliances. The connected documents describe concrete vectors via the JSON‑RPC API that enable remote command execution, including u...

CVE-2018-11184

CVE-2018-11184 affects Quest DR Series Disk Backup Software up to build 4.0.3.1, where the UsageService’s get usage operation can be abused to inject commands via the type parameter (as shown in the 7.42 example). The vulnerability arises from unsanitized user input used to construct a command li...

CVE-2018-11155

CVE-2018-11155 concerns Quest DR Series Disk Backup software prior to 4.0.3.1, where Core Security and CNVD/NVD sources describe multiple command-injection vulnerabilities in the DR appliance’s JSON-RPC/administration interfaces. The most explicit entry notes command injection allowing remote cod...

CVE-2018-11163

Quest DR Series Disk Backup Software before 4.0.3.1 is affected by multiple command‑injection vulnerabilities in the DR Series appliances’ web/JSON‑RPC interface. Public details document a range of CVEs (including CVE-2018-11143 to CVE-2018-11194) that allow remote or authenticated attackers to i...

CVE-2018-11193

CVE-2018-11193 is a privilege-escalation flaw in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory details multiple command-injection paths in the DR Series Web UI (JSON-RPC) enabling an attacker with web access to reach root via webadmin privileges (e.g., ocashell, env...

CVE-2018-11187

CVE-2018-11187 affects Quest DR Series Disk Backup Software 4.0.3.1 (and earlier in 4.0.3) through a command injection in the Global View add_member API via the RemoteHost parameter. An unauthenticated attacker could inject commands and gain arbitrary code execution on the appliance (up to root) ...

CVE-2018-11158

The CVE-2018-11158 entry concerns Quest DR Series Disk Backup Software. CoreSecurity’s CORE-2018-0002 and related materials describe multiple command-injection vulnerabilities in DR Series appliances (versions prior to 4.0.3.1) with both unauthenticated and authenticated vectors via the web UI an...

CVE-2018-11165

CVE-2018-11165 pertains to Quest DR Series Disk Backup Software before 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliances’ JSON-RPC/Web interfaces. The Core advisory details unauthenticated and authenticated vectors (e.g., CVE-2018-11143 through CVE...

CVE-2018-11154

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 12 of 46...

CVE-2018-11180

CVE-2018-11180 is a vulnerability in the Quest DR Series CloudPortal registration path where the registrationCode parameter is unsafely used to build a command line. The CoreLabs advisory and PoC details show an attacker can trigger remote command execution by crafting the registrationCode in a r...

CVE-2018-11164

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 22 of 46...

CVE-2018-11161

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 19 of 46...

CVE-2018-11183

Quest DR Series Disk Backup Software before 4.0.3.1 contains multiple command-injection vulnerabilities in its JSON-RPC interface, enabling remote code execution (including unauthenticated login) via numerous endpoints. The CoreLabs CORE-2018-0002 advisory details extensive CVEs (e.g., CVE-2018-1...

CVE-2018-11161

CVE-2018-11161 is a real command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. Connected sources (NVD, CNVD, CoreLabs CORE-2018-0002) describe multiple CVEs in the DR Series family, with CVE-2018-11161 specifically noting that the StorageGroupService deletion p...

CVE-2018-11164

CVE-2018-11164 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. Core/ENISA/public docs detail multiple command-injection vulnerabilities exposed via the web UI/JSON-RPC API, enabling remote code execution (some vectors unauthenticated, others requiring an auth token). The flaws aris...

CVE-2018-11189

CVE-2018-11189 applies to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities in the web UI allow an attacker with/without authentication to execute arbitrary commands as root via various API methods. CoreLabs details show a progression of CVEs ...

CVE-2018-11146

Affected product: Quest DR Series Disk Backup Software. Vulnerabilities allow remote command execution via several web/API entry points; notably, command injection in update_pw and setAdminPassword. Versions prior to 4.0.3.1 are implicated. Build 4.0.3.1 reportedly fixes these issues. If upgradin...

CVE-2018-11192

Summary of findings (CVE-2018-11192 family) : The Quest DR Series Disk Backup Appliances (hardware/software) release prior to 4.0.3.1 contain multiple command-injection vulnerabilities in the DR Series web/JSON-RPC interfaces. The CoreLabs CORE-2018-0002 advisory documents a range of CVEs (e.g., ...

CVE-2018-11170

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 28 of 46...

Quest DR Series Disk Backup Multiple Vulnerabilities

Advisory ID Internal CORE-2018-0002 1. Advisory Information Title: Quest DR Series Disk Backup Multiple Vulnerabilities Advisory ID: CORE-2018-0002 Advisory URL:https://www.coresecurity.com/core-labs/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities Date published: 2018-05-31 Date o...