GCVE-110-CERTCC-2018-877837

Advisory PublishedCVSS 9.3/10

Vulnetix · Advisory published June 1, 2019

The Quest Kace System Management (K1000) Appliance contains multiple vulnerabilities, including a blind SQL injection vulnerability and a stored cross site scripting vulnerability. It also suffers from misconfigurations in the cross-origin resource sharing (CORS) mechanism and improperly validates source communications.

Download JSON Open in Console

Risk Scores

CVSS 2.0

9.3/10

Critical · AV:N/AC:M/Au:N/C:C/I:C/A:C

certcc-cam

impact0population0exploitation0widely_known0score_current0ease_of_exploitation0

certcc-vrda

d1_direct_report1

certcc-cvss-temporal-env

temporal_score7.3remediation_levelOFreport_confidenceCenvironmental_score5.48031772512target_distributionMenvironmental_vectorCDP:N/TD:M/CR:ND/IR:ND/AR:ND