CVE-2018-11171

CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...

CVE-2018-11180

CVE-2018-11180 is a vulnerability in the Quest DR Series CloudPortal registration path where the registrationCode parameter is unsafely used to build a command line. The CoreLabs advisory and PoC details show an attacker can trigger remote command execution by crafting the registrationCode in a r...

CVE-2018-11187

CVE-2018-11187 affects Quest DR Series Disk Backup Software 4.0.3.1 (and earlier in 4.0.3) through a command injection in the Global View add_member API via the RemoteHost parameter. An unauthenticated attacker could inject commands and gain arbitrary code execution on the appliance (up to root) ...

CVE-2018-11146

Affected product: Quest DR Series Disk Backup Software. Vulnerabilities allow remote command execution via several web/API entry points; notably, command injection in update_pw and setAdminPassword. Versions prior to 4.0.3.1 are implicated. Build 4.0.3.1 reportedly fixes these issues. If upgradin...

CVE-2018-11173

CVE-2018-11173 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, with multiple command-injection flaws exposed via the web interface and JSON-RPC API. CoreLabs advisory CORE-2018-0002 documents a family of related vulnerabilities (CVE-2018-11143 through CVE-2018-11194) enabling remo...

CVE-2018-11164

CVE-2018-11164 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. Core/ENISA/public docs detail multiple command-injection vulnerabilities exposed via the web UI/JSON-RPC API, enabling remote code execution (some vectors unauthenticated, others requiring an auth token). The flaws aris...

CVE-2018-11188

CVE-2018-11188 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 documents multiple command-injection vulnerabilities in the DR Series appliances (e.g., unauthenticated and authenticated JSON-RPC/API calls) that could allow remote code execution with root priv...

CVE-2018-11165

CVE-2018-11165 pertains to Quest DR Series Disk Backup Software before 4.0.3.1, where multiple command-injection vulnerabilities were identified across the DR appliances’ JSON-RPC/Web interfaces. The Core advisory details unauthenticated and authenticated vectors (e.g., CVE-2018-11143 through CVE...

CVE-2018-11191

CVE-2018-11191 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs describes multiple privilege-escalation vectors resulting from the DR appliance web interface and related components: attackers who gain access can escalate from the webserver user (webadmin) to root via local ...

CVE-2018-11166

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...

CVE-2018-11147

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 5 of 46...

CVE-2018-11189

CVE-2018-11189 applies to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities in the web UI allow an attacker with/without authentication to execute arbitrary commands as root via various API methods. CoreLabs details show a progression of CVEs ...

CVE-2018-11181

Quest DR Series Disk Backup appliances running versions before 4.0.3.1 are affected by multiple command injection vulnerabilities in the web/JSON‑RPC interfaces (e.g., unauthenticated Logon and various authenticated endpoints), enabling remote code execution with root privileges on vulnerable dev...

CVE-2018-11193

CVE-2018-11193 is a privilege-escalation flaw in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory details multiple command-injection paths in the DR Series Web UI (JSON-RPC) enabling an attacker with web access to reach root via webadmin privileges (e.g., ocashell, env...

CVE-2018-11159

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 17 of 46...

CVE-2018-11179

The CVE-2018-11179 entry concerns Quest DR Series Disk Backup software prior to 4.0.3.1, which, along with related CVEs in the CORE-2018-0002 advisory, contains multiple command-injection vulnerabilities in the DR Series appliances. Affected product: Quest DR Series Disk Backup Software (multiple...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11167

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

CVE-2018-11169

CVE-2018-11169 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 details multiple command-injection vulnerabilities in the DR appliance’s web interface/JSON-RPC API across various components (e.g., login, user update/delete, password updates, container/storage...

CVE-2018-11171: Improper Neutralization of Special Elements used in an OS Command

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 29 of 46...