CVE-2018-11174

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 32 of 46...

CVE-2018-11173

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 31 of 46...

CVE-2018-11172

CVE-2018-11172 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities were identified in the DR Series appliances’ web/JSON-RPC interfaces. The CoreLabs advisory details unauthenticated and authenticated vectors that allow remote execut...

CVE-2018-11176

Quest DR Series Disk Backup Software vulnerable to command injection via DREncryption::set_passphrase (CVE-2018-11176). Proof-of-concept shows attacker can inject commands through the passphrase parameter, enabling arbitrary code execution with the appliance’s privileges. The CoreLabs advisory CO...

CVE-2018-11177

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 35 of 46...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11176

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 34 of 46...

CVE-2018-11175

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 33 of 46...

CVE-2018-11175

CVE-2018-11175 and related CVEs describe multiple remote command injection flaws in Quest DR Series Disk Backup Appliances prior to 4.0.3.1. Core Security/CoreLabs and CNVD/NVD entries confirm affected components include the web UI and JSON-RPC endpoints, enabling attackers to execute arbitrary c...

CVE-2018-11171

CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...

CVE-2018-11178

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 36 of 46...

CVE-2018-11178

CVE-2018-11178 is part of a set of related command-injection vulnerabilities in Quest DR Series Disk Backup appliances (Quest DR Series Disk Backup Software) affecting versions up to 4.0.3.1. The CoreLabs CORE-2018-0002 advisory and subsequent materials describe multiple CVEs (e.g., CVE-2018-1114...

CVE-2018-11150

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 8 of 46...

CVE-2018-11183

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

CVE-2018-11171

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 29 of 46...

CVE-2018-11194

Summary: CVE-2018-11194 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling privilege escalation. The related CORE advisory CORE-2018-0002 details multiple command-injection and privilege-escalation vectors on DR Series appliances, describing root-level access via web interfac...

CVE-2018-11156

CVE-2018-11156 affects Quest DR Series Disk Backup Software (DR Series appliances) prior to version 4.0.3.1. Multiple connected sources describe a family of command-injection vulnerabilities in the DR Series web UI/JSON‑RPC API that allows remote attackers to execute arbitrary commands on the app...

CVE-2018-11167

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10907)

The Quest KACE System Management Appliance provides comprehensive system management for all network-connected devices. A command injection vulnerability exists in the '/common/downloadagentinstaller.php' script in Quest KACE System Management Appliance 8.0.318. An anonymous user can exploit this...

Quest KACE System Management Appliance Path Traversal Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A path traversal vulnerability exists in Quest KACE System Management Appliance version 8.0.318. The vulnerability can be exploited to read arbitrary files via the 'checksum' parameter in the...