7905 matches found
CVE-2018-11164
CVE-2018-11164 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. Core/ENISA/public docs detail multiple command-injection vulnerabilities exposed via the web UI/JSON-RPC API, enabling remote code execution (some vectors unauthenticated, others requiring an auth token). The flaws aris...
CVE-2018-11169
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 27 of 46...
CVE-2018-11156
CVE-2018-11156 affects Quest DR Series Disk Backup Software (DR Series appliances) prior to version 4.0.3.1. Multiple connected sources describe a family of command-injection vulnerabilities in the DR Series web UI/JSON‑RPC API that allows remote attackers to execute arbitrary commands on the app...
CVE-2018-11152
CVE-2018-11152 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection in the JSON-RPC API (set_compression) where the compressionLevel parameter is unsafely used to build a shell command, enabling remote execution. Affected product: Quest DR Series...
CVE-2018-11153
The CVE-2018-11153 entry concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliance’s JSON-RPC/Web UI surface. The CoreLabs CORE advisory details unauthenticated and authenticated command-injection vecto...
CVE-2018-11166
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...
CVE-2018-11166
Summary (supported by provided documents): Quest DR Series Disk Backup Software, versions prior to 4.0.3.1, contains multiple command-injection vulnerabilities (CVE-2018-11143 through CVE-2018-11194) in its DR appliance web/JSON-RPC interfaces. The CoreLabs advisory CORE-2018-0002 details numerou...
CVE-2018-11194
Summary: CVE-2018-11194 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling privilege escalation. The related CORE advisory CORE-2018-0002 details multiple command-injection and privilege-escalation vectors on DR Series appliances, describing root-level access via web interfac...
CVE-2018-11193
CVE-2018-11193 is a privilege-escalation flaw in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory details multiple command-injection paths in the DR Series Web UI (JSON-RPC) enabling an attacker with web access to reach root via webadmin privileges (e.g., ocashell, env...
CVE-2018-11191
CVE-2018-11191 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs describes multiple privilege-escalation vectors resulting from the DR appliance web interface and related components: attackers who gain access can escalate from the webserver user (webadmin) to root via local ...
CVE-2018-11152
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 10 of 46...
CVE-2018-11162
CVE-2018-11162 corresponds to a command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory documents a remote, authenticated issue in DRStorageGroup.update where unsanitized input in newGroup (e.g., Name, Compression_mode) is used to build a co...
CVE-2018-11188
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 46 of 46...
CVE-2018-11171
CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...
CVE-2018-11176
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 34 of 46...
CVE-2018-11156
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 14 of 46...
CVE-2018-11154
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 12 of 46...
CVE-2018-11161
CVE-2018-11161 is a real command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. Connected sources (NVD, CNVD, CoreLabs CORE-2018-0002) describe multiple CVEs in the DR Series family, with CVE-2018-11161 specifically noting that the StorageGroupService deletion p...