CVE-2018-11168

Summary: CVE-2018-11168 affects Quest DR Series Disk Backup software prior to 4.0.3.1 and is part of a broader set of command‑injection vulnerabilities in DR Series appliances. The connected documents describe concrete vectors via the JSON‑RPC API that enable remote command execution, including u...

CVE-2018-11170

CVE-2018-11170 concerns Quest DR Series Disk Backup Software prior to 4.0.3.1. The concern is a broader set of command-injection vulnerabilities found in the Core Security CORE-2018-0002 advisory, affecting multiple CVEs (e.g., CVE-2018-11143 to CVE-2018-11194) via the JSON-RPC/web interfaces. Th...

CVE-2018-11181

Quest DR Series Disk Backup appliances running versions before 4.0.3.1 are affected by multiple command injection vulnerabilities in the web/JSON‑RPC interfaces (e.g., unauthenticated Logon and various authenticated endpoints), enabling remote code execution with root privileges on vulnerable dev...

CVE-2018-11185

CVE-2018-11185 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple input vectors in the web interface/JSON‑RPC allow command execution. The CoreLabs Core Advisory details a wide set of command‑injection flaws (e.g., unauthenticated and authenticated paths) across num...

CVE-2018-11187

CVE-2018-11187 affects Quest DR Series Disk Backup Software 4.0.3.1 (and earlier in 4.0.3) through a command injection in the Global View add_member API via the RemoteHost parameter. An unauthenticated attacker could inject commands and gain arbitrary code execution on the appliance (up to root) ...

CVE-2018-11185

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 43 of 46...

CVE-2018-11155

CVE-2018-11155 concerns Quest DR Series Disk Backup software prior to 4.0.3.1, where Core Security and CNVD/NVD sources describe multiple command-injection vulnerabilities in the DR appliance’s JSON-RPC/administration interfaces. The most explicit entry notes command injection allowing remote cod...

CVE-2018-11188

CVE-2018-11188 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. CoreLabs CORE-2018-0002 documents multiple command-injection vulnerabilities in the DR Series appliances (e.g., unauthenticated and authenticated JSON-RPC/API calls) that could allow remote code execution with root priv...

CVE-2018-11177

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 35 of 46...

CVE-2018-11143

Summary of available details: Quest DR Series Disk Backup Software prior to version 4.0.3.1 contains multiple command-injection vulnerabilities exposed via its web/JSON-RPC API. The most critical issue, CVE-2018-11143, allows unauthenticated remote command execution through the Logon endpoint, wi...

CVE-2018-11163

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 21 of 46...

CVE-2018-11177

CVE-2018-11177 affects Quest DR Series Disk Backup Software prior to 4.0.3.1. The Root Cause is command injection via user-supplied input used to build shell commands in the appliance’s JSON-RPC/web interfaces. The CoreLabs advisory and the companion PoCs enumerate multiple privileged and authent...

CVE-2018-11187

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 45 of 46...

CVE-2018-11191

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 3 of 6...

CVE-2018-11192

Summary of findings (CVE-2018-11192 family) : The Quest DR Series Disk Backup Appliances (hardware/software) release prior to 4.0.3.1 contain multiple command-injection vulnerabilities in the DR Series web/JSON-RPC interfaces. The CoreLabs CORE-2018-0002 advisory documents a range of CVEs (e.g., ...

CVE-2018-11190

The CORE advisory details remote command injection and privilege escalation flaws in Quest DR Series Disk Backup Software prior to build 4.0.3.1. Exploitation occurs via the DR Series web UI/JSON-RPC methods (e.g., Logon, update, add, set, delete, etc.), allowing authenticated or unauthenticated ...

CVE-2018-11190

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 2 of 6...

CVE-2018-11189

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 1 of 6...

CVE-2018-11180

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 38 of 46...

CVE-2018-11178

CVE-2018-11178 is part of a set of related command-injection vulnerabilities in Quest DR Series Disk Backup appliances (Quest DR Series Disk Backup Software) affecting versions up to 4.0.3.1. The CoreLabs CORE-2018-0002 advisory and subsequent materials describe multiple CVEs (e.g., CVE-2018-1114...