Quest Foglight for Databases vulnerabilities

An incorrect permission assignment vulnerability in Quest Foglight for Databases allows local privilege escalation. The flaw exists in the product installer due to incorrect permissions on a folder used by the product.

Quest Foglight for Databases uses a hard-coded cryptographic key within the symmetricDecrypt method. An attacker able to execute low-privileged code can exploit this flaw to escalate privileges and execute arbitrary code as SYSTEM.

The getSource method in Quest Foglight for Databases improperly restricts XML External Entity (XXE) references. An unauthenticated remote attacker can cause the XML parser to access an attacker-specified URI and disclose information in the context of the application.

The unzipFile method in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

The renderTemplateString method in Quest Foglight for Databases fails to properly validate a user-supplied string before processing it with the template engine, resulting in server-side template injection. An authenticated remote attacker can execute arbitrary code as SYSTEM.

The loadEvolveLicense script in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

The loadManageServerLicense script in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

A vulnerability in the FileServlet class of Quest Foglight for Databases allows an authenticated remote attacker to disclose sensitive information. The issue results from the lack of proper validation of a user-supplied path before it is used in file operations.

The installLicense script in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

The runScript function in Quest Foglight for Databases performs incorrect authorization before allowing access to functionality. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

The extractAndCreateUploadInfoList method in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

The paFnUploadFileAndCreateInfo script in Quest Foglight for Databases lacks proper validation of a user-supplied path before file operations, enabling directory traversal. An authenticated remote attacker can exploit this to execute arbitrary code as SYSTEM.

An XML External Entity (XXE) vulnerability in the AbstractParser class of Quest Foglight for Databases allows unauthenticated remote attackers to disclose sensitive information. A crafted XML document referencing a URI causes the parser to embed external content for further processing.

Quest Foglight for Databases contains a deserialization of untrusted data vulnerability in the baseRmiServiceExporter component. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.

In Quest Foglight for Databases, the writeTopologySectionToFile method does not validate a user-supplied path before using it in file operations. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.

The ForgeMBeanServerSupport module in Quest Foglight for Databases lacks authentication before allowing access to functionality. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.