CVE-2019-11604

An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.

• CWE-79

• http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/40Exploit, Mailing List, Third Party Advisory
• https://www.rcesecurity.com/Third Party Advisory
• http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/May/40Exploit, Mailing List, Third Party Advisory
• https://www.rcesecurity.com/Third Party Advisory

Published

May 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11599The coredump implementation in the Linux kernel before 5.0.1…7
• CVE-2019-1160Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-11600A SQL injection vulnerability in the activities API in OpenP…
• CVE-2019-11601A directory traversal vulnerability in remote access to back…7.5
• CVE-2019-11602Leakage of stack traces in remote access to backup & restore…5.3
• CVE-2019-11603A HTTP Traversal Attack in earlier versions than ProSyst mBS…7.5
• CVE-2019-11605An issue was discovered in GitLab Community and Enterprise E…7.5
• CVE-2019-11606doorGets 7.0 has a sensitive information disclosure vulnerab…
• CVE-2019-11607doorGets 7.0 has a sensitive information disclosure vulnerab…
• CVE-2019-11608doorGets 7.0 has a sensitive information disclosure vulnerab…
• CVE-2019-11609doorGets 7.0 has a sensitive information disclosure vulnerab…
• CVE-2019-1161An elevation of privilege vulnerability exists when the MpSi…7.1