480 matches found
Design/Logic Flaw
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; querie...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Tenant Groups /tenancy/tenant-groups/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Providers /circuits/providers/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Circuit Types /circuits/circuit-types/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Rack /dcim/rack/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Provider Accounts /circuits/provider-accounts/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Power Panels /dcim/power-panels/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Locations /dcim/locations/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
Cross site scripting
A stored cross-site scripting XSS vulnerability in the Create Sites /dcim/sites/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
PT-2023-24502 · Netbox · Netbox
Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Contacts function, specifically at the /tenancy/contacts/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a...
CVE-2023-33786
NetBox CVE-2023-33786 is a stored XSS in the Create Circuit Types function (Name field) affecting NetBox v3.5.1. An attacker can inject a crafted payload to execute arbitrary web scripts or HTML. The connected records confirm the vulnerability description across multiple feeds; no exploitation st...
NetBox 跨站脚本漏洞
NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows...
NetBox 跨站脚本漏洞
NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows...
CVE-2023-33787
A stored cross-site scripting XSS vulnerability in the Create Tenant Groups /tenancy/tenant-groups/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
CVE-2023-33786
A stored cross-site scripting XSS vulnerability in the Create Circuit Types /circuits/circuit-types/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
CVE-2023-33795
NetBox 3.5.1 contains a stored XSS in the Create Contact Roles feature at /tenancy/contact-roles/, exploitable by injecting a crafted payload into the Name field. This could allow attackers to execute arbitrary web scripts or HTML in the context of a user session. The vulnerability is documented ...
CVE-2023-33798
Summary: CVE-2023-33798 is a stored XSS vulnerability in NetBox v3.5.1, affecting the Create Rack endpoint (/dcim/rack/) where a crafted payload in the Name field can execute scripts/HTML. The cited sources consistently describe the issue as a stored XSS in the Name field of the Rack creation for...
CVE-2023-33788
NetBox firmware: CVE-2023-33788 is a stored XSS in NetBox v3.5.1 affecting the Create Providers endpoint (/circuits/providers/) where a crafted payload in the Name field can execute scripts. The Red Hat, OSV, NVD, CVE lists describe the same issue; exploitation details are not provided in the doc...
NetBox 跨站脚本漏洞
NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from a security issue in the Create Contacts /tenancy/contacts/ function, and ca...
CVE-2023-33793
A stored cross-site scripting XSS vulnerability in the Create Power Panels /dcim/power-panels/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...