KS
Product
KACE System Management Appliance
On CISA KEVExploited in the wildRansomware-linked
11
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 3Low 0
Watch
Add KACE System Management Appliance to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-11138 RansomwareIn wildKEV | 9.8 | May 31 | Quest KACE System Management Appliance Remote Command Execution Vulnerability Affected: 8.0.318 |
| CVE-2018-11141 | 9.8 | May 31 | The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to… Affected: 8.0.318 |
| CVE-2018-11140 | 9.8 | May 31 | The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in… Affected: 8.0.318 |
| CVE-2018-11136 | 9.8 | May 31 | The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL… Affected: 8.0.318 |
| CVE-2018-11139 | 8.8 | May 31 | The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute… Affected: 8.0.318 |
| CVE-2018-11135 | 8.8 | May 31 | The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks Affected: 8.0.318 |
| CVE-2018-11134 | 8.8 | May 31 | In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges… Affected: 8.0.318 |
| CVE-2018-11132 | 8.8 | May 31 | In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges… Affected: 8.0.318 |
| CVE-2018-11137 | 6.5 | May 31 | The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www'… Affected: 8.0.318 |
| CVE-2018-11133 | 6.1 | May 31 | The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting Affected: 8.0.318 |
| CVE-2018-11142 | 5.5 | May 31 | The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost Affected: 8.0.318 |
Showing 11