Quest
97 CVEs across 22 Quest products. Browse Quest vulnerabilities, severities, and proof-of-concept exploits.
Quest products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32088 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-fo… |
CVE-2021-32087 | High | 8.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password… |
CVE-2021-32086 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL… |
CVE-2021-32085 | High | 8.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts… |
CVE-2021-32084 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets… |
CVE-2026-9787 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-9786 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-9785 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9784 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9783 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-9782 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9781 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-9780 | High | 8.8 | 2026-06-25 | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2026-7570 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-7569 | High | 8.8 | 2026-06-25 | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2025-67813 | Medium | 5.3 | 2026-01-12 | Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication |
CVE-2025-12874 | | 2025-12-19 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modu… | |
CVE-2025-56689 | Medium | 4.6 | 2025-09-03 | One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass… |
CVE-2025-26850 | Critical | 9.3 | 2025-07-05 | The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems. |
CVE-2025-32975 | Critical | 10.0 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2023-33254 | Medium | 6.5 | 2023-05-21 | There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privile… |
CVE-2022-38220 | Medium | 6.1 | 2023-03-01 | An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML. |
CVE-2022-30285 | Critical | 9.8 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid c… |
CVE-2022-29808 | High | 7.5 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. |
CVE-2022-29807 | Critical | 9.8 | 2022-08-02 | A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_ag… |
CVE-2021-44031 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerabi… |
CVE-2021-44030 | Medium | 6.1 | 2021-12-22 | Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery. |
CVE-2021-44029 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization explo… |
CVE-2021-44028 | Medium | 5.5 | 2021-12-22 | XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-201… |
CVE-2020-35727 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseD… |
CVE-2020-35726 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35725 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35724 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.j… |
CVE-2020-35723 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportP… |
CVE-2020-35722 | Medium | 6.5 | 2021-01-11 | CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to… |
CVE-2020-35721 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseA… |
CVE-2020-35720 | Medium | 5.4 | 2021-01-11 | Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when… |
CVE-2020-35719 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35206 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially… |
CVE-2020-35205 | Critical | 9.8 | 2021-01-11 | Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbo… |
CVE-2020-35204 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the Policy… |
CVE-2020-35203 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially… |
CVE-2020-8868 | Critical | 9.8 | 2020-03-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required t… |
CVE-2019-20504 | Critical | 9.8 | 2020-03-09 | service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharac… |
CVE-2019-13081 | Medium | 5.4 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php servic… |
CVE-2019-13080 | Medium | 5.4 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to ex… |
CVE-2019-13079 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-13078 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-13077 | Medium | 6.1 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attack… |
CVE-2019-13076 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-12918 | Critical | 9.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected pa… |
CVE-2019-12917 | Medium | 6.1 | 2019-11-06 | A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via t… |
CVE-2019-10973 | High | 7.2 | 2019-07-08 | Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting too… |
CVE-2018-5406 | High | 8.8 | 2019-06-03 | The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism… |
CVE-2018-5405 | Medium | 5.4 | 2019-06-03 | The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject… |
CVE-2018-5404 | Medium | 6.5 | 2019-06-03 | The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potenti… |
CVE-2019-11604 | Medium | 6.1 | 2019-05-24 | An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated… |
CVE-2018-11194 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6). |
CVE-2018-11193 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6). |
CVE-2018-11192 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6). |
CVE-2018-11191 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6). |
CVE-2018-11190 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6). |
CVE-2018-11189 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6). |
CVE-2018-11188 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46). |
CVE-2018-11187 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46). |
CVE-2018-11186 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46). |
CVE-2018-11185 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46). |
CVE-2018-11184 | High | 7.2 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46). |
CVE-2018-11183 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46). |
CVE-2018-11182 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46). |
CVE-2018-11181 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46). |
CVE-2018-11180 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46). |
CVE-2018-11179 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46). |
CVE-2018-11178 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46). |
CVE-2018-11177 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46). |
CVE-2018-11176 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46). |
CVE-2018-11175 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46). |
CVE-2018-11174 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46). |
CVE-2018-11173 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46). |
CVE-2018-11172 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46). |
CVE-2018-11171 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46). |
CVE-2018-11170 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46). |
CVE-2018-11169 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46). |
CVE-2018-11168 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46). |
CVE-2018-11167 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46). |
CVE-2018-11166 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46). |
CVE-2018-11165 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46). |
CVE-2018-11164 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46). |
CVE-2018-11163 | High | 7.2 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46). |
CVE-2018-11162 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46). |
CVE-2018-11161 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46). |
CVE-2018-11160 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46). |
CVE-2018-11159 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46). |
CVE-2018-11158 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46). |
CVE-2018-11157 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46). |
CVE-2018-11156 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46). |
CVE-2018-11155 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46). |
CVE-2018-11154 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46). |
CVE-2018-11153 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46). |
CVE-2018-11152 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46). |