OSNEXUS QuantaStor Multiple Vulnerabilities

OSNEXUS QuantaStor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:osnexus:quantastor"; if...

CVE-2017-9979

CVE-2017-9979 affects OSNEXUS QuantaStor v4 prior to 4.3.1. The issue arises when a REST call for a non-existent/unsupported method triggers an error response that is not sanitized, enabling an attacker to inject arbitrary HTML or JavaScript (XSS). Affected component: REST endpoint handling for m...

CVE-2017-9979

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary...