CVE-2021-42080

Affected software : OSNEXUS QuantaStor (before 6.0.0.355). Vulnerability : CVE-2021-42080 – Reflected XSS via a crafted URL in the QuantaStor web interface (qstorapi/echo?inputMessage). Root cause : improper handling/encoding of user-supplied input reflected in the response. Impact : potential to...

CVE-2021-42082

CVE-2021-42082 affects OSNEXUS QuantaStor prior to 6.0.0.355, enabling local users to escalate to root by executing scripts (e.g., via a crafted upgrade script). Evidence from CVE records and related sources confirms the affected product/version and local-privilege escalation impact, with a PoC s...

CVE-2021-4406

CVE-2021-4406 affects OSNEXUS QuantaStor. Reports in multiple connected documents (including CVE lists and vendor CSAs) describe an authenticated attacker who can create alerts in the alerts management dialog that trigger a stored XSS, with the test alert running a command as root via a webhook/U...

CVE-2021-42081

Summary: CVE-2021-42081 affects OSNEXUS QuantaStor prior to 6.0.0.355, where an authenticated administrator can remotely execute arbitrary shell commands via the API. The issue arises from a command-injection style vulnerability exposed in the storage system API, enabling control of the host when...

CVE-2021-42079

CVE-2021-42079 affects OSNEXUS QuantaStor prior to 6.0.0.355. An authenticated administrator can craft an alert via POST to alertConfigSet and trigger alertRaise, enabling a server-side request forgery (SSRF) through the QuantaStor alerting workflow. The POC shows constructing an alert with vario...

CVE-2021-42083

CVE-2021-42083 affects OSNEXUS QuantaStor (notably prior to version 6.0.0.355; CVE list references 6.0.0.335) and is an authenticated stored XSS via the alert manager ITSM webhook. The documented PoC shows that an authenticated attacker can inject a payload through a webhook URL/field, causing a ...