PT-2025-26742

Name of the Vulnerable Software and Affected Versions: Quest KACE Systems Management Appliance SMA versions 13.0.x through 13.0.384 Quest KACE Systems Management Appliance SMA versions 13.1.x through 13.1.80 Quest KACE Systems Management Appliance SMA versions 13.2.x through 13.2.182 Quest KACE...

CVE-2025-32976

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass...

Quest KACE Systems Management Appliance 访问控制错误漏洞

Quest Software Quest KACE Systems Management Appliance is an IT asset management appliance from Quest Software, Inc. An access control error vulnerability exists in the Quest KACE Systems Management Appliance, which stems from a flaw in the license replacement feature that could lead to a denial ...

PT-2025-26740

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance SMA versions 13.0.x prior to 13.0.385 Quest KACE Systems Management Appliance SMA versions 13.1.x prior to 13.1.81 Quest KACE Systems Management Appliance SMA versions 13.2.x prior to 13.2.183 Quest KACE...

CVE-2025-32977: Improper Verification of Cryptographic Signature

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

CVE-2025-32975

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid...

CVE-2025-32977

The Quest KACE Systems Management Appliance (SMA) is vulnerable to an unauthenticated backup file upload flaw in versions prior to 13.0.385 , 13.1.81 , 13.2.183 , 14.0.341 (Patch 5) , and 14.1.101 (Patch 4) . The root cause is a weakness in the cryptographic signature validation process , which a...

Quest KACE Systems Management Appliance 安全漏洞

Quest Software Quest KACE Systems Management Appliance is an IT asset management appliance from Quest Software, USA. A security vulnerability exists in the Quest KACE Systems Management Appliance that stems from a logical flaw in the implementation of two-factor authentication, which could lead t...

CVE-2025-32975

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid...

Quest KACE Systems Management Appliance 14.1 2FA Bypass

Seralys Security Advisory - Quest KACE SMA contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access. Version 14.1...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

CVE-2025-32976: Authentication Bypass Using an Alternate Path or Channel

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass...

CVE-2025-32978

The Quest KACE Systems Management Appliance (SMA) is vulnerable to a flaw where unauthenticated users can replace system licenses via a web interface designed for license renewal. This vulnerability allows attackers to swap valid licenses with expired or trial versions, leading to a denial of ser...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

CVE-2025-32976

Quest KACE Systems Management Appliance (SMA) contains a logic flaw in its two-factor authentication (2FA) implementation. This vulnerability allows authenticated users to bypass TOTP-based 2FA requirements during the validation process, potentially leading to elevated access . Affected versions ...

CVE-2024-23774

An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components. This allows local attackers to execute code of their choice with NT Authority\SYSTEM privileges...

CVE-2024-23773

An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component. Local attackers can delete any file of their choice with NT Authority\SYSTEM privileges...

CVE-2023-48118

SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request to the Common.svc WSDL page...

CVE-2022-30285

In Quest KACE Systems Management Appliance SMA through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials...

CVE-2022-29807

A SQL injection vulnerability exists within Quest KACE Systems Management Appliance SMA through 12.0 that can allow for remote code execution via downloadagentinstaller.php...