qsan vulnerabilities

Recent CVEs affecting qsan products. 31 tracked.

qsan has 31 tracked vulnerabilities, 14 critical. A fixed release or vendor patch exists for 30. Most recent: 2021-08-02. Highest priority: CVE-2021-32531 (score 60/100).

CVE-2021-37216 MEDIUM 6.1 MITIGATE MITIGATE QSAN Storage Manager header page parameters does not filter special characters
CVE-2021-32535 CRITICAL 9.8 UPGRADE The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to o
CVE-2021-32534 CRITICAL 9.8 UPGRADE QSAN SANOS factory reset function does not filter special parameters
CVE-2021-32533 CRITICAL 9.8 UPGRADE The QSAN SANOS setting page does not filter special parameters
CVE-2021-32532 HIGH 7.5 UPGRADE Path traversal vulnerability in back-end analysis function in QSAN XEVO allows remote attackers to download ar
CVE-2021-32531 CRITICAL 9.8 UPGRADE OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary
CVE-2021-32530 CRITICAL 9.8 UPGRADE OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to e
CVE-2021-32529 CRITICAL 9.8 UPGRADE UPGRADE Command injection vulnerability in QSAN XEVO, SANOS allows remote unauthenticated attackers to execute arbitra
CVE-2021-32528 MEDIUM 5.3 UPGRADE Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the
CVE-2021-32527 HIGH 7.5 UPGRADE Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbit
CVE-2021-32526 MEDIUM 6.5 UPGRADE Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticat
CVE-2021-32525 CRITICAL 9.1 UPGRADE The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the c
CVE-2021-32524 CRITICAL 9.1 UPGRADE Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary co
CVE-2021-32523 CRITICAL 9.1 UPGRADE Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the acce
CVE-2021-32522 CRITICAL 9.8 UPGRADE UPGRADE Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS a
CVE-2021-32521 HIGH 7.3 UPGRADE UPGRADE Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to
CVE-2021-32520 CRITICAL 9.8 UPGRADE Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ cr
CVE-2021-32519 CRITICAL 9.8 UPGRADE UPGRADE Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS
CVE-2021-32518 HIGH 7.5 UPGRADE A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then a
CVE-2021-32517 HIGH 7.5 UPGRADE Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to downloa
CVE-2021-32516 HIGH 7.5 UPGRADE Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitra
CVE-2021-32515 MEDIUM 5.3 UPGRADE Directory listing vulnerability in share_link in QSAN Storage Manager allows attackers to list arbitrary direc
CVE-2021-32514 HIGH 7.5 UPGRADE Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to re
CVE-2021-32513 CRITICAL 9.8 UPGRADE QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthentic
CVE-2021-32512 CRITICAL 9.8 UPGRADE QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenti
CVE-2021-32511 MEDIUM 4.3 UPGRADE QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated att
CVE-2021-32510 MEDIUM 4.3 UPGRADE QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated
CVE-2021-32509 MEDIUM 6.5 UPGRADE Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attac
CVE-2021-32508 MEDIUM 6.5 UPGRADE Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated att
CVE-2021-32507 MEDIUM 6.5 UPGRADE Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated atta
CVE-2021-32506 MEDIUM 6.5 UPGRADE Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attacker

FAQ

How do I fix qsan vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is qsan being exploited right now?

None of the tracked qsan CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which qsan CVE should I patch first?

CVE-2021-32531 currently ranks highest (60/100): OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary .

Products

RSS feed for qsan · ← Back to latest CVEs