VVVSecurity

2 exploits Active since Aug 2017
CVE-2017-9978 EXPLOITDB MEDIUM text WRITEUP
OSNEXUS QuantaStor < 4.3.0 - User Enumeration via Error Message
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for common usernames.
CVSS 5.3
CVE-2017-9979 EXPLOITDB MEDIUM text WRITEUP
OSNEXUS QuantaStor < 4.3.0 - Cross-Site Scripting via REST Error Response
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
CVSS 6.1