CVE-2021-32085

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2011-4047

The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access...

CVE-2011-4436

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4046

The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code...

CVE-2011-4048: Undefined Security Weakness

The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account, which makes it easier for remote attackers to obtain sensitive information from the database by leveraging the default credentials...

CVE-2011-4047: Improper Control of Generation of Code

The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access...

CVE-2011-4436: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4048

Dell KACE K2000 System Deployment Appliance is affected by CVE-2011-4048 due to a default username/password for the read-only reporting account, enabling remote attackers to access the database and obtain sensitive information. The issue is described in multiple sources referencing default creden...

CVE-2011-4046

The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext inside a PHP script, enabling context-dependent attackers to read sensitive data from script source. Several connected sources corroborate that this flaw can lead to privilege abuse and unauthorized ...

CVE-2011-4046: Undefined Security Weakness

The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code...

PT-2011-4828

Name of the Vulnerable Software and Affected Versions Dell KACE K2000 System Deployment Appliance affected versions not specified Description The issue concerns a default username and password for the read-only reporting account in the Dell KACE K2000 System Deployment Appliance. This default...

PT-2011-4827

Name of the Vulnerable Software and Affected Versions Dell KACE K2000 System Deployment Appliance affected versions not specified Description The issue allows remote attackers to execute arbitrary commands by leveraging database write access. Recommendations At the moment, there is no information...

PT-2011-4826

Name of the Vulnerable Software and Affected Versions Dell KACE K2000 System Deployment Appliance affected versions not specified Description The issue allows context-dependent attackers to obtain sensitive information by examining script source code, as the recovery account password is stored in...

PT-2011-4953

Name of the Vulnerable Software and Affected Versions Dell KACE K2000 System Deployment Appliance affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the administrative web interface. These vulnerabilities allow remote attackers to...