Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 4 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 5 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 25 of 46...

Command injection

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 10 of 46...

CVE-2018-11162

CVE-2018-11162 corresponds to a command-injection vulnerability in Quest DR Series Disk Backup Software prior to 4.0.3.1. The CoreLabs advisory documents a remote, authenticated issue in DRStorageGroup.update where unsanitized input in newGroup (e.g., Name, Compression_mode) is used to build a co...

CVE-2018-11175

CVE-2018-11175 and related CVEs describe multiple remote command injection flaws in Quest DR Series Disk Backup Appliances prior to 4.0.3.1. Core Security/CoreLabs and CNVD/NVD entries confirm affected components include the web UI and JSON-RPC endpoints, enabling attackers to execute arbitrary c...

CVE-2018-11171

CVE-2018-11171 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection flaws exist in the web UI/JSON-RPC API allowing remote code execution with root privileges. Documentation in CORE-2018-0002 enumerates a large set of related CVEs (e.g., CVE-2018-11143 ...

CVE-2018-11166

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 24 of 46...

CVE-2018-11194

Summary: CVE-2018-11194 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling privilege escalation. The related CORE advisory CORE-2018-0002 details multiple command-injection and privilege-escalation vectors on DR Series appliances, describing root-level access via web interfac...

CVE-2018-11180

CVE-2018-11180 is a vulnerability in the Quest DR Series CloudPortal registration path where the registrationCode parameter is unsafely used to build a command line. The CoreLabs advisory and PoC details show an attacker can trigger remote command execution by crafting the registrationCode in a r...

CVE-2018-11156

CVE-2018-11156 affects Quest DR Series Disk Backup Software (DR Series appliances) prior to version 4.0.3.1. Multiple connected sources describe a family of command-injection vulnerabilities in the DR Series web UI/JSON‑RPC API that allows remote attackers to execute arbitrary commands on the app...

CVE-2018-11148

The provided documents confirm a set of command-injection vulnerabilities in Quest DR Series Disk Backup Software running older than 4.0.3.1. Specifically, the CoreLabs CORE-2018-0002 advisory details multiple CVEs (notably CVE-2018-11143 through CVE-2018-11179 variants) that allow remote code ex...

CVE-2018-11184

CVE-2018-11184 affects Quest DR Series Disk Backup Software up to build 4.0.3.1, where the UsageService’s get usage operation can be abused to inject commands via the type parameter (as shown in the 7.42 example). The vulnerability arises from unsanitized user input used to construct a command li...

CVE-2018-11183

Quest DR Series Disk Backup Software before 4.0.3.1 contains multiple command-injection vulnerabilities in its JSON-RPC interface, enabling remote code execution (including unauthenticated login) via numerous endpoints. The CoreLabs CORE-2018-0002 advisory details extensive CVEs (e.g., CVE-2018-1...

CVE-2018-11183

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

CVE-2018-11184

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 42 of 46...

CVE-2018-11153

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 11 of 46...

CVE-2018-11150

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 8 of 46...

CVE-2018-11152

CVE-2018-11152 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The vulnerability is a command-injection in the JSON-RPC API (set_compression) where the compressionLevel parameter is unsafely used to build a shell command, enabling remote execution. Affected product: Quest DR Series...