Security Advisory for XSS Vulnerability in Qsync Central

Summary

A cross-site scripting vulnerability has been reported to affect Qsync Central. If successfully exploited, the vulnerability could allow remote attackers to inject Javascript code in the compromised application.

We have already fixed these issues in following versions.

• QTS 4.2.6: build 20180829 and later
• QTS 4.3.3: Qsync Central 3.0.2.01 and later
• QTS 4.3.4: Qsync Central 3.0.3.01 and later
• QTS 4.3.5: Qsync Central 3.0.4.01 and later

Recommendation

To resolve the issue, you must perform the following:

• QTS 4.2.6: Update QTS to the latest version.
• QTS 4.3.3, 4.3.4, and 4.3.5: Update Qsync Central to the latest version.

Installing the QTS Update

1. Log on to QTS as administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   QTS downloads and installs the latest available update.

Updating Qsync Central

1. Log on to QTS as administrator.
2. Open the App Center, and then click the Search icon.
   A search box appears.
3. Type “Qsync Central”, and then press ENTER.
   The Qsync Central application appears in the search results list.
4. Click Update.
   A confirmation message appears.
5. Click OK.
   The application is updated.