Vulnerabilities > Quest
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-06-02 | CVE-2018-11149 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11148 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11147 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11146 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11145 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11144 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46). | 6.5 |
| 2018-06-02 | CVE-2018-11143 | OS Command Injection vulnerability in Quest Disk Backup Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46). | 7.5 |
| 2018-05-31 | CVE-2018-11142 | Incorrect Authorization vulnerability in Quest Kace System Management Appliance 8.0.318 The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. | 2.1 |
| 2018-05-31 | CVE-2018-11141 | Path Traversal vulnerability in Quest Kace System Management Appliance 8.0.318 The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. | 7.5 |
| 2018-05-31 | CVE-2018-11140 | SQL Injection vulnerability in Quest Kace System Management Appliance 8.0.318 The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type). | 7.5 |