CVE-2019-13076

CVE-2019-13076 affects Quest KACE Systems Management Appliance Server Center 9.1.317. The vulnerability is a SQL injection in the /userui/ticket_list.php component, using parameters order[0][column] and order[0][dir]. An authenticated user can potentially execute arbitrary SQL commands against th...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

CVE-2019-12918

CVE-2019-12918 affects Quest KACE Systems Management Appliance Server Center v9.1.317. Multiple connected sources confirm a SQL injection vulnerability in the file software_library.php, targeting parameters order[0][column] and order[0][dir]. The root cause is insufficient validation of externall...

CVE-2019-12918

Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is softwarelibrary.php and affected parameters are order0column and order0dir...

CVE-2019-12917

A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/softwarelibrary.php component via the PATHINFO...

CVE-2019-12917

The CVE-2019-12917 entry describes a reflected XSS in Quest KACE Systems Management Appliance Server Center 9.1.317, specifically affecting the userui/software_library.php component via PATH_INFO. Connected documents corroborate a cross-site scripting vulnerability stemming from improper validati...

CVE-2019-10973

Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface...

CVE-2019-10973

Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface...

Design/Logic Flaw

Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface...

CVE-2019-10973

Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface...

CVE-2019-10973

CVE-2019-10973 affects Quest KACE Systems Management Appliance (SMA). The vulnerability is due to improper input validation that allows unintentional access to the appliance via troubleshooting tools in the administrator UI. Affected products include KACE SMA versions 8.0.x, 8.1.x, and 9.0.x. The...

Quest KACE Systems Management Appliance

1. EXECUTIVE SUMMARY CVSS v3 2.7 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Quest Equipment : KACE Systems Management Appliance SMA Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an administrative...

Collections Firm Behind LabCorp, Quest Breaches Files for Bankruptcy

A medical billing firm responsible for a recent eight-month data breach that exposed the personal information on nearly 20 million Americans has filed for bankruptcy, citing "enormous expenses" from notifying affected consumers and the loss of its four largest customers. The filing, first reporte...

VulnCheck KEV: CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution...

LabCorp: 7.7 Million Consumers Hit in Collections Firm Breach

Medical testing giant LabCorp. said today personal and financial data on some 7.7 million consumers were exposed by a breach at a third-party billing collections firm. That third party -- the American Medical Collection Agency AMCA -- also recently notified competing firm Quest Diagnostics that a...

Quest Diagnostics data breach affects 12 million customers

By Uzair Amir Clinical laboratory firm Quest Diagnostics Inc. has admitted exposure of personal information of nearly 11.9 million customers after its web payment page was accessed by an unauthorized individual. In a press release, the company revealed that its billing system, which is managed by...

Quest Software Kace K1000 Appliance Cross-Site Scripting Vulnerability

Quest Software Kace K1000 Appliance is a system management appliance from Quest Software, USA. The product is used for software license management, patch and endpoint security management, software distribution and server monitoring functions. A cross-site scripting vulnerability exists in Quest...

Quest Software Kace K1000 Appliance SQL Injection Vulnerability

Quest Software Kace K1000 Appliance is a system management appliance from Quest Software, USA. The product is used for software license management, patch and endpoint security management, software distribution and server monitoring functions. A SQL injection vulnerability exists in Quest Kace K10...

CVE-2018-5405

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of oth...

CVE-2018-5406

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing CORS mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator accou...