CVE-2021-32523: Improper Authorization

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

QSAN Storage Manager 授权问题漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. An authorization issue vulnerability exists in QSAN Storage Manager prior to version 3.3.1 build 202101041800, which stems from the product misassigning permissions on critical resource management and can...

CVE-2021-32524: Improper Neutralization of Special Elements used in an OS Command

Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

PT-2021-19736

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue allows remote authenticated attackers to list arbitrary directories via the file path parameter in the ViewBroserList component. This can be exploited by manipulating the fil...

PT-2021-19739 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue is related to improper access control in the FirmwareUpgrade component of QSAN Storage Manager, allowing remote attackers to reboot and discontinue the device. Recommendation...

PT-2021-19742 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue is related to improper access control in the share link feature of QSAN Storage Manager, allowing remote attackers to download arbitrary files by exploiting a particular...

PT-2021-19749 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: The issue allows remote privileged users to bypass access control and execute arbitrary commands due to an improper authorization vulnerability. Recommendations: Contact QSAN a...

PT-2021-19754 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: The issue allows remote attackers to obtain system information without permissions due to an observable behavioral discrepancy vulnerability. Recommendations: Contact QSAN and...

CVE-2021-32513: Improper Neutralization of Special Elements used in an OS Command

QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

PT-2021-19737

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue arises from improper filtering of special parameters in QuickInstall, allowing remote unauthenticated attackers to inject and execute arbitrary commands. Recommendations: For...

CVE-2021-32526: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password files. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

PT-2021-19735

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue allows remote authenticated attackers to list arbitrary directories by injecting the file path parameter in the antivirus function, potentially leading to unauthorized access...

PT-2021-19732

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: A path traversal issue in the FileDownload feature of QSAN Storage Manager allows remote authenticated attackers to download arbitrary files by manipulating the Url path parameter...

PT-2021-19747

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue allows local attackers to escalate privileges due to the use of a MAC address as an authenticated password. There is no information provided about the...

PT-2021-19731

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue allows remote authenticated attackers to download arbitrary files due to an Absolute Path Traversal vulnerability in the GetImage function. This is achieved by manipulating t...

PT-2021-19744

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.2 QSAN XEVO versions prior to 2.1.0 QSAN SANOS versions prior to 2.1.0 Description: The issue allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash due to the use o...

PT-2021-19751

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue allows remote attackers to access the control interface with administrator credentials by using a hard-coded password in the debug mode, enabling them to execute restricted...

PT-2021-19750

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: A command injection issue allows remote privileged users to execute arbitrary commands. The estimated number of potentially affected devices worldwide is not available. There i...

PT-2021-19746

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager affected versions not specified Description: The issue involves the use of a hard-coded cryptographic key in QSAN Storage Manager, allowing attackers to obtain users' credentials and related permissions. Recommendations:...

PT-2021-19748

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue is related to an improper restriction of excessive authentication attempts, allowing remote attackers to discover users' credentials and obtain access vi...