Design/Logic Flaw

QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

Design/Logic Flaw

QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

Design/Logic Flaw

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

Command injection

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

Authorization

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32533 QSAN SANOS - Command Injection

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2021-32531

The CVE-2021-32531 vulnerability affects QSAN XEVO (flash data management system). It stems from an input handling flaw in the Init function that allows OS command injection, enabling remote attackers to execute arbitrary commands without privileges. Impact is high (CVE-2021-32531, CVSS v3.1: 9.8...

CVE-2021-32531 QSAN XEVO - Command Injection Following via Init function

OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32530 QSAN XEVO - Command Injection Following via Array function

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32523 QSAN Storage Manager - Improper Authorization

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32512

CVE-2021-32512 affects QSAN Storage Manager’s QuickInstall function, where improper filtering of special parameters allows remote, unauthenticated command execution. The vulnerability exists in QSAN Storage Manager 3.3.1 and earlier; exploitation could enable arbitrary commands to run on the NAS ...

CVE-2021-32512 QSAN Storage Manager - Command Injection Following via QuickInstall function

QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and execute arbitrary commands. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...

QSAN Storage Manager 操作系统命令注入漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. QSAN Storage Manager suffers from an operating system command injection vulnerability that can be exploited by remote attackers to execute arbitrary commands...

Command Execution Vulnerability in PatrolFlow Multiservice Security Gateway Intelligent Management Platform of Byzoro Networks (CNVD-2021-51332)

Beijing Byzoro Network Technology Co., Ltd. is a high-tech enterprise dedicated to building the next-generation secure Internet. A command execution vulnerability exists in the PatrolFlow multi-service security gateway intelligent management platform of Byzoro Networks, which can be exploited by...

Command Execution Vulnerability in Guangzhou Traffic - Xingxun Tong

Guangzhou Transportation-Xingxuntong is a comprehensive transportation information service software launched by Guangzhou Public Transportation Group under the guidance of Guangzhou Transportation Bureau. A command execution vulnerability exists in Guangzhou Transportation - Xingxun Tong, which c...

QSAN XEVO 操作系统命令注入漏洞

QSAN XEVO is a flash data management system from QSAN China. Reduces repetitive tasks and provides complete data analysis. A command injection vulnerability exists in QSAN XEVO that stems from the product's INIT function not filtering special elements of user input data. An attacker could use thi...

Command Execution Vulnerability Exists in Sapido GR-1733

The Sapido GR-1733 is a gigabit wireless router. A command execution vulnerability exists in the Sapido GR-1733, which can be exploited by an attacker to execute arbitrary commands...

Command Execution Vulnerability in PatrolFlow Multiservice Security Gateway Intelligent Management Platform of Byzoro Networks

Beijing Byzoro Network Technology Co., Ltd. is a high-tech enterprise dedicated to building the next-generation secure Internet. A command execution vulnerability exists in the PatrolFlow multi-service security gateway intelligent management platform of Byzoro Networks, which can be exploited by...

Command execution vulnerability in Zhiyuan OA (CNVD-2021-51370)

Zhiyuan OA is a collaborative management software, a digital collaborative operation platform for medium-sized and large group organizations. A command execution vulnerability exists in Zhiyuan OA, which can be exploited by an attacker to execute arbitrary commands...

Command Execution Vulnerability in Dongying Smart Public Transportation App

Dongying Smart Bus App is a client application that allows you to check bus routes and arrival times in the palm of your hand. Dongying Smart Bus APP has a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...