PT-2021-19753

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: A path traversal issue in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files by injecting a file path in the download function...

QSAN Storage Manager 操作系统命令注入漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. QSAN Storage Manager suffers from an operating system command injection vulnerability that can be exploited by remote attackers to execute arbitrary commands...

PT-2021-19747

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue allows local attackers to escalate privileges due to the use of a MAC address as an authenticated password. There is no information provided about the...

CVE-2021-32522: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32520: Use of Hard-coded Cryptographic Key

Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32534: Improper Neutralization of Special Elements used in an OS Command

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32533: Improper Neutralization of Special Elements used in an OS Command

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

QSAN Storage Manager 安全漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A directory traversal vulnerability exists in QSAN Storage Manager version 3.3.1 build 202101041800 and earlier versions, which can be exploited by an attacker to traverse files in an arbitrary directory...

PT-2021-19754 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: The issue allows remote attackers to obtain system information without permissions due to an observable behavioral discrepancy vulnerability. Recommendations: Contact QSAN and...

QSAN Storage Manager 安全漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. An access control error vulnerability exists in FirmwareUpgrade in QSAN Storage Manager 3.3.1 and earlier versions. A remote attacker could exploit this vulnerability to reboot and disrupt the device...

PT-2021-19739 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue is related to improper access control in the FirmwareUpgrade component of QSAN Storage Manager, allowing remote attackers to reboot and discontinue the device. Recommendation...

PT-2021-19752

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: The issue is related to an incorrect permission assignment for a critical resource in QSAN Storage Manager, allowing authenticated remote attackers to access arbitrary password...

QSAN XEVO 路径遍历漏洞

QSAN XEVO is a flash data management system from QSAN China. Reduces repetitive tasks and provides complete data analysis. A path traversal vulnerability exists in QSAN XEVO, which stems from a failure of the product's back-end analysis function to filter input data for special characters. The...

PT-2021-19756

Name of the Vulnerable Software and Affected Versions: QSAN XEVO versions prior to 2.1.0 Description: The issue is an OS command injection vulnerability in the Array function of QSAN XEVO, allowing remote unauthenticated attackers to execute arbitrary commands via the status parameter...

QSAN Storage Manager 后置链接漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A security vulnerability exists in QSAN Storage Manager, which can be exploited by remote attackers to create symbolic links and then access arbitrary files...

PT-2021-19738

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue is related to the QsanTorture component in QSAN Storage Manager, which fails to properly filter special parameters. This allows remote unauthenticated attackers to inject and...

QSAN Storage Manager 操作系统命令注入漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A command injection vulnerability exists in QSAN Storage Manager 3.3.1 and earlier versions. The vulnerability stems from QuickInstall failing to properly filter special parameters. A remote,...

QSAN Storage Manager 安全漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. An improper access control vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. A remote attacker could exploit this vulnerability to download arbitrary files via specific...

PT-2021-19751

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue allows remote attackers to access the control interface with administrator credentials by using a hard-coded password in the debug mode, enabling them to execute restricted...

CVE-2021-32513: Improper Neutralization of Special Elements used in an OS Command

QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...