CVE-2017-9979

CVE-2017-9979 affects OSNEXUS QuantaStor v4 prior to 4.3.1. The issue arises when a REST call for a non-existent/unsupported method triggers an error response that is not sanitized, enabling an attacker to inject arbitrary HTML or JavaScript (XSS). Affected component: REST endpoint handling for m...

CVE-2017-9978

OSNEXUS QuantaStor v4 before 4.3.1 contains an information-disclosure vulnerability where the error message for non-existent users can be used to enumerate valid usernames. This CVE (CVE-2017-9978) is documented across multiple sources; affected versions are prior to 4.3.1. Remediation: upgrade t...

CVE-2021-42080

Affected software : OSNEXUS QuantaStor (before 6.0.0.355). Vulnerability : CVE-2021-42080 – Reflected XSS via a crafted URL in the QuantaStor web interface (qstorapi/echo?inputMessage). Root cause : improper handling/encoding of user-supplied input reflected in the response. Impact : potential to...

CVE-2021-4406

CVE-2021-4406 affects OSNEXUS QuantaStor. Reports in multiple connected documents (including CVE lists and vendor CSAs) describe an authenticated attacker who can create alerts in the alerts management dialog that trigger a stored XSS, with the test alert running a command as root via a webhook/U...

CVE-2021-42082

CVE-2021-42082 affects OSNEXUS QuantaStor prior to 6.0.0.355, enabling local users to escalate to root by executing scripts (e.g., via a crafted upgrade script). Evidence from CVE records and related sources confirms the affected product/version and local-privilege escalation impact, with a PoC s...

CVE-2021-42081

Summary: CVE-2021-42081 affects OSNEXUS QuantaStor prior to 6.0.0.355, where an authenticated administrator can remotely execute arbitrary shell commands via the API. The issue arises from a command-injection style vulnerability exposed in the storage system API, enabling control of the host when...

CVE-2021-42079

CVE-2021-42079 affects OSNEXUS QuantaStor prior to 6.0.0.355. An authenticated administrator can craft an alert via POST to alertConfigSet and trigger alertRaise, enabling a server-side request forgery (SSRF) through the QuantaStor alerting workflow. The POC shows constructing an alert with vario...

CVE-2021-42083

CVE-2021-42083 affects OSNEXUS QuantaStor (notably prior to version 6.0.0.355; CVE list references 6.0.0.335) and is an authenticated stored XSS via the alert manager ITSM webhook. The documented PoC shows that an authenticated attacker can inject a payload through a webhook URL/field, causing a ...