Quest KACE System Management Appliance 8.0.318
Approved changes feed: RSS · Atom
cpe:2.3:a:quest:kace_system_management_appliance:8.0.318:*:*:*:*:*:*:*
part: a version: 8.0.318 update: *
| Vendor | Quest (91a9bf17-30f5-5671-ad35-2f5777bc4995) |
|---|---|
| Product | Kace System Management Appliance (a16bfbe4-4fa1-57f4-bc12-47c453e71f00) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-11142 |
vulnerable | 2026-06-08 05:10:37.922988 |
Details available
The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
Published: 2018-05-31T18:00:00.000Z
Updated: 2024-08-05T08:01:51.156Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11141 |
vulnerable | 2026-06-08 05:10:37.922721 |
Details available
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
Published: 2018-05-31T18:00:00.000Z
Updated: 2024-08-05T08:01:51.141Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11140 |
vulnerable | 2026-06-08 05:10:37.922451 |
Details available
The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).
Published: 2018-05-31T18:00:00.000Z
Updated: 2024-08-05T08:01:51.145Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11139 |
vulnerable | 2026-06-08 05:10:37.922052 |
Details available
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.
Published: 2018-05-31T18:00:00.000Z
Updated: 2024-08-05T08:01:51.161Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11138 |
vulnerable | 2026-06-08 05:10:37.921663 |
Details available
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
Published: 2018-05-31T18:00:00.000Z
Updated: 2025-10-21T23:45:50.901Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11137 |
vulnerable | 2026-06-08 05:10:37.921207 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11136 |
vulnerable | 2026-06-08 05:10:37.920928 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11135 |
vulnerable | 2026-06-08 05:10:37.920646 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11134 |
vulnerable | 2026-06-08 05:10:37.920352 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11133 |
vulnerable | 2026-06-08 05:10:37.919916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11132 |
vulnerable | 2026-06-08 05:10:37.919525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.