Kace Systems Management Appliance vulnerabilities
6 known vulnerabilities in Kace Systems Management Appliance from Quest. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
KACE Systems Management Appliance: Incorrect Authorization
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
- 10.0 Critical severity
Quest KACE Systems Management Appliance (SMA) Improper Authentication Exploited
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to
- 7.8 High severity
kace_systems_management_appliance: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components. This allows local attackers to execute code of their choice with NT Author
- 7.8 High severity
kace_systems_management_appliance: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component. Local attackers can delete any file of their choice with NT Authority\SYSTEM privileges.
- 9.8 Critical severity
Kace Systems Management Appliance: Inadequate Encryption Strength
In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials.
- 9.8 Critical severity
Kace Systems Management Appliance: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.