Directory traversal

The 'checksum' parameter of the '/common/downloadattachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script...

CVE-2018-11137

The 'checksum' parameter of the '/common/downloadattachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script...

PT-2018-10328

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue allows for the reading of arbitrary files with 'www' privileges via Directory Traversal in the '/common/download attachment.php' script. This can be achieved by abusi...

CVE-2018-11137: Improper Limitation of a Pathname to a Restricted Directory

The 'checksum' parameter of the '/common/downloadattachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script...