CVE-2021-32519

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

PT-2021-19748

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue is related to an improper restriction of excessive authentication attempts, allowing remote attackers to discover users' credentials and obtain access vi...

CVE-2021-32519: Use of Password Hash With Insufficient Computational Effort

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32535: Use of Hard-coded Credentials

The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbitrary functions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32534: Improper Neutralization of Special Elements used in an OS Command

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32533: Improper Neutralization of Special Elements used in an OS Command

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32529: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32522: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

QSAN’s various products have vulnerabilities related to trust management.

QSAN SANOS and others are products of QSAN China.QSAN SANOS is a SAN storage management operating system.QSAN XEVO is a flash data management system.QSAN Storage Manager is a NAS operating system. A trust management issue vulnerability exists in several QSAN products, which can be exploited by a...

PT-2021-19760

Name of the Vulnerable Software and Affected Versions: QSAN SANOS versions prior to 2.1.0 Description: The QSAN SANOS factory reset function does not filter special parameters, allowing remote attackers to inject and execute arbitrary commands without permissions. Recommendations: For versions...

PT-2021-19759

Name of the Vulnerable Software and Affected Versions: QSAN SANOS versions prior to 2.1.0 Description: The QSAN SANOS setting page does not filter special parameters, allowing remote attackers to inject and execute arbitrary commands without permissions. Recommendations: For versions prior to...

PT-2021-19755

Name of the Vulnerable Software and Affected Versions: QSAN XEVO, SANOS affected versions not specified Description: A command injection issue allows remote unauthenticated attackers to execute arbitrary commands. Recommendations: Contact QSAN and refer to recommendations in the QSAN Document for...

PT-2021-19761

Name of the Vulnerable Software and Affected Versions: QSAN SANOS versions prior to 2.1.0 Description: The issue concerns hard-coded default credentials in QSAN SANOS, allowing unauthenticated remote attackers to obtain administrator's permission and execute arbitrary functions. Recommendations:...

QSAN SANOS Operating System Command Injection Vulnerability

QSAN SANOS is the SAN storage management operating system from QSAN China. It comes with a refreshingly easy-to-use Web GUI and can be easily deployed into any infrastructure. An injection vulnerability exists in QSAN SANOS, which stems from the product's setting page not filtering user-entered...

PT-2021-19747

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue allows local attackers to escalate privileges due to the use of a MAC address as an authenticated password. There is no information provided about the...

PT-2021-19744

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.2 QSAN XEVO versions prior to 2.1.0 QSAN SANOS versions prior to 2.1.0 Description: The issue allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash due to the use o...

QSAN’s various products have security vulnerabilities

QSAN SANOS is a SAN storage management operating system. QSAN XEVO is a flash data management system. QSAN Storage Manager is a NAS operating system. several QSAN products are vulnerable to an access control error that could be exploited by remote attackers to discover user credentials and gain...

QSAN SANOS Operating System Command Injection Vulnerability

QSAN SANOS is the SAN storage management operating system from QSAN China. It comes with a refreshingly easy-to-use Web GUI and can be easily deployed into any infrastructure. A security vulnerability exists in QSAN SANOS that stems from the QSAN SANOS Restore Factory Settings feature not filteri...

CVE-2021-32521: Use of Hard-coded Password

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities

Description Various Cisco IOS, PIX Firewall, Firewall Services Module FWSM, VPN 3000 Series Concentrator, and MDS Series SanOS releases are prone to denial of service attacks. These issues are due to security flaws in Cisco's IPSec implementation. The vulnerabilities may be triggered by malformed...