CVE-2021-32510

CVE-2021-32510 affects QSAN Storage Manager. A directory traversal vulnerability exists in the antivirus page that allows remote authenticated attackers to list arbitrary directories by injecting a file path parameter. Affected versions include 3.3.1 (build 202101041800) and earlier; the issue is...

CVE-2021-32510 QSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus function

QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary directories by injecting file path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32509 QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc function

Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32509

CVE-2021-32509 describes an absolute path traversal in QSAN Storage Manager's FileviewDoc function. The vulnerability allows remote authenticated attackers to access arbitrary files by injecting a Symbolic Link via the Url path parameter. Multiple sources confirm affected versions include pre-3.3...

CVE-2021-32508 QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming function

Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32508

CVE-2021-32508 affects QSAN Storage Manager: a path traversal via the FileStreaming component allows remote authenticated attackers to access arbitrary files by injecting a symbolic link through the Url path parameter. Vulnerable for versions prior to 3.3.3; fixed in 3.3.3. Impact details and vec...

CVE-2021-32507 QSAN Storage Manager - Absolute Path Traversal via FileDownload function

Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32507

Summary: CVE-2021-32507 is an absolute path traversal vulnerability in the FileDownload function of QSAN Storage Manager. The flaw allows remote authenticated attackers to download arbitrary files via the URL path parameter. It affects QSAN Storage Manager versions up to 3.3.1 (and earlier per CN...

CVE-2021-32506 QSAN Storage Manager - Absolute Path Traversal via GetImage function

Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32506

The CVE-2021-32506 entry concerns QSAN Storage Manager (QSAN Storage Manager NAS OS). A path traversal vulnerability exists in the GetImage function that does not validate the URL path parameter, enabling remote authenticated attackers to download arbitrary files. The issue is mitigated by updati...

CVE-2021-32524

Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32525

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been...

CVE-2021-32523

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32526

Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32532

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32528

Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32521

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32515

Directory listing vulnerability in sharelink in QSAN Storage Manager allows attackers to list arbitrary directories and further access credential information. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32516

Path traversal vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

CVE-2021-32517

Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...