CVE-2018-11145

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 3 of 46...

CVE-2018-11143

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 1 of 46...

CVE-2018-11147

CVE-2018-11147 pertains to Quest DR Series Disk Backup Software prior to 4.0.3.1, where multiple command-injection vulnerabilities exist in the web interface/JSON‑RPC API. Public-advisory text identifies a primary unauthenticated remote code-execution vector (section 7.1) that could allow an atta...

CVE-2018-11157

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 15 of 46...

CVE-2018-11159

CVE-2018-11159 (Quest DR Series Disk Backup) Product: Quest DR Series Disk Backup Software (appliances) prior to version 4.0.3.1. Issue: In the JSON-RPC API, the get_storage_group_statistics call accepts a parameter named group that is not sanitized, enabling an attacker to inject system commands...

CVE-2018-11167

CVE-2018-11167 affects Quest DR Series Disk Backup Software prior to 4.0.3.1, enabling command injection through the appliance web interface/JSON-RPC paths. Core documentation shows a family of related command-injection vulnerabilities (e.g., unauthenticated login and authenticated actions) that ...

CVE-2018-11157

CVE-2018-11157 affects Quest DR Series Disk Backup Software (v4.0.3.1 and earlier). CoreLabs/Core advisory details a command-injection vulnerability in the DR appliance Web/JSON-RPC API, specifically the join domain functionality via the ActiveDirectoryService module where the domain parameter ca...

Quest KACE System Management Virtual Appliance Path Traversal Vulnerability

Quest KACE System Management Virtual Appliance is an IT asset management appliance from Quest Software, USA. A path traversal vulnerability exists in Quest KACE System Management Virtual Appliance version 8.0.318. The vulnerability can be exploited by an attacker to write and delete files with th...

Quest KACE System Management Appliance Command Injection Vulnerability (CNVD-2018-10907)

The Quest KACE System Management Appliance provides comprehensive system management for all network-connected devices. A command injection vulnerability exists in the '/common/downloadagentinstaller.php' script in Quest KACE System Management Appliance 8.0.318. An anonymous user can exploit this...

Quest KACE System Management Appliance Command Injection Vulnerability

The Quest KACE System Management Appliance provides comprehensive system management for all network-connected devices. A command injection vulnerability exists in the '/common/ajaxemailconnectiontest.php' script in Quest KACE System Management Appliance 8.0.318. An authenticated user can exploit...

Quest / Dell KACE Systems Management Appliance (SMA) Detection (HTTP)

HTTP based detection of Quest / Dell KACE Systems Management Appliance SMA. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Quest KACE System Management Appliance SQL Injection Vulnerability (CNVD-2018-15268)

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A SQL injection vulnerability exists in the '/common/downloadagentinstaller.php' script in version 8.0.318 of the Quest KACE System Management Appliance, which originates from the program failing ...

Quest KACE System Management Appliance PHP Object Injection Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A PHP object injection vulnerability exists in the '/adminui/errordetails.php' script in Quest KACE System Management Appliance version 8.0.318. An attacker can exploit this vulnerability to injec...

Quest KACE System Management Appliance Cross-Site Scripting Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A cross-site scripting vulnerability exists in the 'fmt' parameter of the '/common/runcrossreport.php' script in Quest KACE System Management Appliance version 8.0.318. ' parameter in the...

Quest KACE System Management Appliance Critical Function Insufficient Authorization Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A critical function under-authorization vulnerability exists in Quest KACE System Management Appliance version 8.0.318. An attacker can exploit this vulnerability by modifying the 'Host' and...

Quest KACE System Management Appliance Path Traversal Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A path traversal vulnerability exists in Quest KACE System Management Appliance version 8.0.318. The vulnerability can be exploited to read arbitrary files via the 'checksum' parameter in the...

Quest KACE System Management Appliance SQL Injection Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A SQL injection vulnerability exists in the '/common/runreport.php' script in version 8.0.318 of the Quest KACE System Management Appliance, which stems from the program not filtering incoming...

Design/Logic Flaw

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

Design/Logic Flaw

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

Command injection

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...