CVE-2018-11138

CVE-2018-11138 affects Quest KACE System Management Appliance 8.0.318 where the unauthenticated /common/download_agent_installer.php endpoint can be abused to execute arbitrary commands as the web server user. The Core Security advisory and multiple sources confirm remote code execution via unaut...

CVE-2018-11142

CVE-2018-11142 affects Quest KACE System Management Appliance 8.0.318. The vulnerability is in the web console: systemui/settings_network.php and systemui/settings_patching.php are accessible only from localhost, and an attacker can bypass this restriction by tampering with Host and X_Forwarded_F...

CVE-2018-11139

The CVE-2018-11139 entry describes a command injection in Quest KACE System Management Appliance 8.0.318 via the authenticated-accessible /common/ajax_email_connection_test.php endpoint. The vulnerability allows an authenticated user to inject commands through the unsanitized TEST_SERVER paramete...

CVE-2018-11133

CVE-2018-11133 affects Quest KACE System Management Appliance 8.0.318. The vulnerability is a cross-site scripting flaw in the fmt parameter of /common/run_cross_report.php, enabling arbitrary JavaScript in users’ browsers (CWE-79). The issue is documented in multiple sources (NVD/Nucli, CIRCL, C...

CVE-2018-11134

CVE-2018-11134 affects Quest KACE System Management Appliance 8.0 (Build 8.0.318). The issue is a privilege-escalation vector in the Sudo Server component: a command available to the web server user could change other users’ passwords, including the kace_support account, which has full sudo privi...

CVE-2018-11136

The 'orgID' parameter received by the '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, a blind time-based type...

CVE-2018-11141

The 'IMAGESJSON' and 'attachmentstoremove' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write...

CVE-2018-11141

CVE-2018-11141 affects Quest KACE System Management Virtual Appliance 8.0.318. The vulnerability is a path traversal issue in the advisory/authored UI where the IMAGES_JSON and attachments_to_remove[] parameters can cause arbitrary file write and delete operations. Proof-of-concept details in the...

CVE-2018-11140

CVE-2018-11140 affects Quest KACE System Management Appliance 8.0.318. The vulnerability is an SQL injection in the /common/run_report.php script via the reportID parameter, which is not sanitized. Public PoCs show an error-based SQL injection that can retrieve database information (e.g., current...

CVE-2018-11135

CVE-2018-11135 concerns the Quest KACE System Management Appliance 8.0.318. An authenticated user can trigger a deserialization-based PHP object injection in the script /adminui/error_details.php, enabling arbitrary PHP object execution as described in the vulnerability notes. Core Security CORE-...

CVE-2018-11137

CVE-2018-11137 affects Quest KACE System Management Appliance 8.0 (Build 8.0.318). The vulnerability is a directory-traversal flaw in the /common/download_attachment.php script, where the checksum parameter can be crafted to read arbitrary files with www privileges (no administrator privileges re...

CVE-2018-11138

The ‘/common/downloadagentinstaller.php’ script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Quest KACE Systems Management Command Injection

This module exploits a command injection vulnerability in Quest KACE Systems Management Appliance version 8.0.318 and possibly prior. The downloadagentinstaller.php file allows unauthenticated users to execute arbitrary commands as the web server user www. A valid Organization ID is required. The...

PT-2018-10326 · Quest · Quest Kace System Management Appliance

Name of the Vulnerable Software and Affected Versions: Quest KACE System Management Appliance version 8.0.318 Description: The issue allows authenticated users to conduct PHP object injection attacks through the script '/adminui/error details.php'. Recommendations: For Quest KACE System Managemen...

Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest KACE System Management Appliance Multiple Vulnerabilities 1. Advisory Information Title: Quest KACE System Management Appliance Multiple Vulnerabilities Advisory ID: CORE-2018-0004 Advisory URL:...

Quest DR Series Disk Backup Software 4.0.3 Code Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest DR Series Disk Backup Multiple Vulnerabilities 1. Advisory Information Title: Quest DR Series Disk Backup Multiple Vulnerabilities Advisory ID: CORE-2018-0002 Advisory URL:...

Quest DR Series Disk Backup Multiple Vulnerabilities

Advisory ID Internal CORE-2018-0002 1. Advisory Information Title: Quest DR Series Disk Backup Multiple Vulnerabilities Advisory ID: CORE-2018-0002 Advisory URL:https://www.coresecurity.com/core-labs/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities Date published: 2018-05-31 Date o...

Quest KACE System Management Appliance Multiple Vulnerabilities

Advisory ID Internal CORE-2018-0004 1. Advisory Information Title: Quest KACE System Management Appliance Multiple Vulnerabilities Advisory ID: CORE-2018-0004 Advisory URL:https://www.coresecurity.com/core-labs/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities Date...

Quest DR Series Disk Backup Software 4.0.3 Code Execution Vulnerability

Exploit for windows platform in category remote exploits Quest DR Series Disk Backup Multiple Vulnerabilities 1. Advisory Information Title: Quest DR Series Disk Backup Multiple Vulnerabilities Advisory ID: CORE-2018-0002 Advisory URL:...

Quest NetVault Backup Multipart Request Authentication Bypass (CVE-2018-1163)

An authentication bypass vulnerability exists in the web interface component of Quest NetVault Backup. The vulnerability is due to how the server handles the HTTP requests...