Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QSAN XEVO - Command Injection Following via Init function
Vulnerability Description
OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
QSAN XEVO 操作系统命令注入漏洞
Vulnerability Description
QSAN XEVO是中国QSAN公司的一款闪存数据管理系统。减少重复性任务并提供完整的数据分析。 QSAN XEVO 中存在操作系统命令注入漏洞，该漏洞源于该产品的INIT函数未过滤用户输入数据的特殊元素。攻击者可通过该漏洞在没有权限的情况下执行任意命令。 以下产品及版本受到影响：QSAN XEVO 1.2.0 (build 202007081800) 之前版本。
CVSS Information
N/A
Vulnerability Type
N/A