Vulnerabilities (CVE)

Filtered by vendor Quest Subscribe
Filtered by product Kace Desktop Authority
Total 4 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-44031 1 Quest 1 Kace Desktop Authority 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.
CVE-2021-44029 1 Quest 1 Kace Desktop Authority 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.
CVE-2021-44028 1 Quest 1 Kace Desktop Authority 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.
CVE-2021-44030 1 Quest 1 Kace Desktop Authority 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.