CVE-2021-32529

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32530

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32519

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

CVE-2021-32521: Use of Hard-coded Password

Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

CVE-2021-32532: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download arbitrary files without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32531: Improper Neutralization of Special Elements used in an OS Command

OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32529: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

PT-2021-19758

Name of the Vulnerable Software and Affected Versions: QSAN XEVO versions prior to 2.1.0 Description: A path traversal vulnerability exists in the back-end analysis function of QSAN XEVO, allowing remote attackers to download arbitrary files without permissions. Recommendations: For versions prio...

QSAN XEVO 操作系统命令注入漏洞

QSAN XEVO is a flash data management system from QSAN China. Reduces repetitive tasks and provides complete data analysis. A command injection vulnerability exists in QSAN XEVO that stems from the product's Array function's status parameter not properly filtering input data for special characters...

QSAN 多款产品信任管理问题漏洞

QSAN SANOS and others are products of QSAN China.QSAN SANOS is a SAN storage management operating system.QSAN XEVO is a flash data management system.QSAN Storage Manager is a NAS operating system. A trust management issue vulnerability exists in several QSAN products, which can be exploited by a...

PT-2021-19747

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue allows local attackers to escalate privileges due to the use of a MAC address as an authenticated password. There is no information provided about the...

CVE-2021-32522: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

QSAN XEVO 路径遍历漏洞

QSAN XEVO is a flash data management system from QSAN China. Reduces repetitive tasks and provides complete data analysis. A path traversal vulnerability exists in QSAN XEVO, which stems from a failure of the product's back-end analysis function to filter input data for special characters. The...

PT-2021-19756

Name of the Vulnerable Software and Affected Versions: QSAN XEVO versions prior to 2.1.0 Description: The issue is an OS command injection vulnerability in the Array function of QSAN XEVO, allowing remote unauthenticated attackers to execute arbitrary commands via the status parameter...

CVE-2021-32519: Use of Password Hash With Insufficient Computational Effort

Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash. The referred vulnerability has been solved with the updated version of QSAN Storage Manager...

PT-2021-19755

Name of the Vulnerable Software and Affected Versions: QSAN XEVO, SANOS affected versions not specified Description: A command injection issue allows remote unauthenticated attackers to execute arbitrary commands. Recommendations: Contact QSAN and refer to recommendations in the QSAN Document for...

QSAN XEVO 操作系统命令注入漏洞

QSAN XEVO is a flash data management system from QSAN China. Reduces repetitive tasks and provides complete data analysis. A command injection vulnerability exists in QSAN XEVO that stems from the product's INIT function not filtering special elements of user input data. An attacker could use thi...

PT-2021-19748

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager, XEVO, SANOS affected versions not specified Description: The issue is related to an improper restriction of excessive authentication attempts, allowing remote attackers to discover users' credentials and obtain access vi...

PT-2021-19744

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.2 QSAN XEVO versions prior to 2.1.0 QSAN SANOS versions prior to 2.1.0 Description: The issue allows remote attackers to recover the plain-text password by brute-forcing the MD5 hash due to the use o...

PT-2021-19757

Name of the Vulnerable Software and Affected Versions: QSAN XEVO versions prior to 2.1.0 Description: The issue allows remote attackers to execute arbitrary commands without permissions due to an OS command injection vulnerability in the Init function. Recommendations: For versions prior to 2.1.0...