{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T03:39:28.355","vulnerabilities":[{"cve":{"id":"CVE-2018-5406","sourceIdentifier":"cret@cert.org","published":"2019-06-03T19:29:01.703","lastModified":"2024-11-21T04:08:45.390","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings."},{"lang":"es","value":"El dispositivo Quest Kace K1000, versiones anteriores a la versión  9.0.270, permite a un atacante remoto explotar el mecanismo de intercambio de recursos de origen cruzado (CORS) mal configurado. Un atacante remoto no autenticado podría aprovechar esta vulnerabilidad para realizar acciones sensibles, como agregar una nueva cuenta de administrador o cambiar la configuración del dispositivo. Un usuario interno malintencionado también podría obtener privilegios de administrador de este dispositivo y usarlo para visitar un enlace malicioso que explota esta vulnerabilidad. Esto podría hacer que la aplicación realice acciones delicadas, como agregar una nueva cuenta de administrador o cambiar la configuración del dispositivo. Un atacante remoto no autenticado podría agregar una cuenta de nivel de administrador o cambiar la configuración del dispositivo."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"cret@cert.org","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:quest:kace_systems_management_appliance_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.270","matchCriteriaId":"24B925CF-12DB-4729-8FD9-5CA8872B6679"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:quest:kace_systems_management_appliance:-:*:*:*:*:*:*:*","matchCriteriaId":"15602132-D4C9-466E-9973-CDE289F23363"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html","source":"cret@cert.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://support.quest.com/kb/288310/cert-coordination-center-report-update","source":"cret@cert.org","tags":["Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/877837/","source":"cret@cert.org","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://support.quest.com/kb/288310/cert-coordination-center-report-update","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/877837/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]}]}}]}