CVE-2021-32520

The CVE-2021-32520 entry concerns QSAN Storage Manager (QSAN NAS OS) and a hard-coded cryptographic key vulnerability. The root cause is use of a hard-coded encryption key, which could allow an attacker to obtain user credentials and related permissions. The available documents consistently descr...

CVE-2021-32520 QSAN Storage Manager - Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32519 QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32519

CVE-2021-32519 affects QSAN Storage Manager, XEVO, and SANOS where password hashes were computed with insufficient computational effort (MD5), enabling remote attackers to recover plaintext passwords. Root cause: MD5 hashing with low iterations/weak protection. Impact: unauthorized disclosure of ...

CVE-2021-32518 QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following

A vulnerability in sharelink in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32518

CVE-2021-32518 affects QSAN Storage Manager (QSAN Storage Manager) where the share_link functionality can be abused by remote attackers to create a symbolic link and access arbitrary files. This is a symbolic-link (symlink) following issue exposed via the share_link path; the root cause is not ex...

CVE-2021-32517 QSAN Storage Manager - Improper Access Control

Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32517

QSAN Storage Manager vulnerable in the share_link feature where improper access control allows remote attackers to download arbitrary files via a specific parameter in the download function. Affected versions are prior to 3.3.3; when updated to v3.3.3, the issue is addressed. Public sources from ...

CVE-2021-32516

Summary: CVE-2021-32516 describes a path traversal in the share_link component of QSAN Storage Manager, allowing remote attackers to download arbitrary files. The vulnerability affects QSAN Storage Manager 3.3.1 and earlier (CNVD/CNNVD notes) and is mitigated by upgrading to version 3.3.3 as cite...

CVE-2021-32516 QSAN Storage Manager - Path Traversal

Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32515 QSAN Storage Manager - Exposure of Information Through Directory Listing

Directory listing vulnerability in sharelink in QSAN Storage Manager allows attackers to list arbitrary directories and further access credential information. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32515

QSAN Storage Manager (QSAN NAS OS by Quantium Technologies) contains a directory traversal flaw in the share_link component that lets an attacker list arbitrary directories and access credential information. Affected versions are 3.3.1 and earlier; remediation is upgrading to v3.3.3 (the fixed re...

CVE-2021-32514 QSAN Storage Manager - Improper Access Control Following via FirwareUpgrade function

Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the device. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32514

CVE-2021-32514 concerns an improper access control flaw in the FirmwareUpgrade component of QSAN Storage Manager. Multiple connected sources confirm that versions prior to 3.3.3 are affected and that a remote attacker could reboot or disrupt the device. The issue is addressed by updating to QSAN ...

CVE-2021-32513

CVE-2021-32513 affects QSAN Storage Manager (QSAN Storage Manager 3.3.1 and earlier). The flaw arises in the QsanTorture functionality where special parameters are not properly filtered, enabling a remote unauthenticated attacker to inject and execute arbitrary commands. Impact is consistent with...

CVE-2021-32513 QSAN Storage Manager - Command Injection Following via QsanTorture function

QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32512

CVE-2021-32512 affects QSAN Storage Manager’s QuickInstall function, where improper filtering of special parameters allows remote, unauthenticated command execution. The vulnerability exists in QSAN Storage Manager 3.3.1 and earlier; exploitation could enable arbitrary commands to run on the NAS ...

CVE-2021-32512 QSAN Storage Manager - Command Injection Following via QuickInstall function

QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32511 QSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList function

QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary directories via the file path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32511

The CVE concerns QSAN Storage Manager and its ViewBroserList directory listing function, which permits directory traversal via a file path parameter. The issue allows remote authenticated attackers to list arbitrary directories, due to a vulnerability in how the browser manifest/listing is handle...