PT-2018-10356

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10345

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10365

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10366

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10368

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10359

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10360

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10361

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

PT-2018-10349

Name of the Vulnerable Software and Affected Versions Quest DR Series Disk Backup software versions prior to 4.0.3.1 Description The issue allows command injection. Recommendations For versions prior to 4.0.3.1, update to version 4.0.3.1 or later to resolve the issue...

Quest / Dell KACE Systems Management Appliance (SMA) Detection (HTTP)

HTTP based detection of Quest / Dell KACE Systems Management Appliance SMA. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-11132

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

CVE-2018-11140

The 'reportID' parameter received by the '/common/runreport.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, an error-based type...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-11139

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...

CVE-2018-11135

The script '/adminui/errordetails.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks...

CVE-2018-11133

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...

CVE-2018-11142

The 'systemui/settingsnetwork.php' and 'systemui/settingspatching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'XForwardedFor' HTTP headers in a POST request. An anonymous user c...

CVE-2018-11136

The 'orgID' parameter received by the '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection in particular, a blind time-based type...

CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

CVE-2018-11137

The 'checksum' parameter of the '/common/downloadattachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script...