Vendors / OSNEXUS Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 3
Exploited now OSNEXUS records in CISA KEV No OSNEXUS vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 74
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
CVSS 3.1 CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00964 · Published 2023-07-10 · No fix listed CWE-77
Priority MEDIUM 51
OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01037 · Published 2026-08-20 · No fix listed CWE-306
Priority MEDIUM 49
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-06-04 · Fixed in 6.6.1 CWE-89
Priority MEDIUM 44
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.
CVSS 3.1 CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.0123 · Published 2023-07-10 · Fixed in 6.0.0.355 CWE-78
Priority LOW 38
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
CVSS 3.1 HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00547 · Published 2023-07-10 · Fixed in 6.0.0.355 CWE-79
Priority LOW 35
Local users are able to execute scripts under root privileges.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00185 · Published 2023-07-10 · Fixed in 6.0.0.355 CWE-269
Priority LOW 34
An attacker is able to launch a Reflected XSS attack using a crafted URL.
CVSS 3.1 HIGH 7.4· Network · No auth · User interaction · EPSS 0.00695 · Published 2023-07-10 · Fixed in 6.0.0.355 CWE-79
Priority LOW 32
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02559 · Published 2017-08-28 · No fix listed CWE-79
Priority LOW 32
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system.
CVSS 3.0 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.04746 · Published 2017-08-28 · No fix listed CWE-200
Priority LOW 29
An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack.
CVSS 3.1 MEDIUM 6.2· Network · High privileges · User interaction · EPSS 0.00694 · Published 2023-07-10 · Fixed in 6.0.0.355 CWE-918
Open these records in search → All records by CVSS severity
4 3 3 0 0
THREATIST.IORead the docs