Quest Kace_system_management_appliance
11 CVEs affecting Quest Kace_system_management_appliance. Latest disclosed: 2018-05-31. Critical: 4, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11141 | Critical | 9.8 | 2018-05-31 | The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318… |
CVE-2018-11140 | Critical | 9.8 | 2018-05-31 | The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL… |
CVE-2018-11138 | Critical | 9.8 | 2018-05-31 | The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to e… |
CVE-2018-11136 | Critical | 9.8 | 2018-05-31 | The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, lea… |
CVE-2018-11139 | High | 8.8 | 2018-05-31 | The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be ab… |
CVE-2018-11135 | High | 8.8 | 2018-05-31 | The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attack… |
CVE-2018-11134 | High | 8.8 | 2018-05-31 | In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs wit… |
CVE-2018-11132 | High | 8.8 | 2018-05-31 | In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized w… |
CVE-2018-11137 | Medium | 6.5 | 2018-05-31 | The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary… |
CVE-2018-11133 | Medium | 6.1 | 2018-05-31 | The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scriptin… |
CVE-2018-11142 | Medium | 5.5 | 2018-05-31 | The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from… |