Quest: Security Vulnerabilities
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
CVSS Score
7.2
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
CVSS Score
8.8
EPSS Score
0.045
Published
2018-06-02
In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.
CVSS Score
8.8
EPSS Score
0.183
Published
2018-05-31
The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
CVSS Score
6.1
EPSS Score
0.087
Published
2018-05-31
In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.
CVSS Score
8.8
EPSS Score
0.03
Published
2018-05-31