Design/Logic Flaw

A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; querie...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Circuit Types /circuits/circuit-types/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Contact Roles /tenancy/contact-roles/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Site Groups /dcim/site-groups/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Power Panels /dcim/power-panels/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Tenants /tenancy/tenants/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Sites /dcim/sites/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Providers /circuits/providers/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33790

NetBox v3.5.1 contains a stored XSS in the Create Locations (/dcim/locations/) Name field. The vulnerability allows an attacker to inject arbitrary web scripts/HTML, with impact limited to user’s session and potentially broader depending on context, as described across multiple feeds (including R...

CVE-2023-33794

NetBox 3.5.1 is affected by a stored XSS vulnerability in the Create Tenants API (endpoint /tenancy/tenants/) where an attacker can inject arbitrary web scripts/HTML via the Name field. Multiple connected sources (NVD, Red Hat, OSV, CVE.org, CNNVD, etc.) confirm the issue as a stored XSS conditio...

CVE-2023-33800

CVE-2023-33800 is a stored XSS in NetBox v3.5.1 affecting the Create Regions endpoint (/dcim/regions/). The Name field can be injected to execute arbitrary scripts/HTML. Public sources consistently describe a stored XSS applicable to NetBox 3.5.1, with a CVSS v3.1 base score of 5.4 (Medium) and a...

CVE-2023-33785

A stored cross-site scripting XSS vulnerability in the Create Rack Roles /dcim/rack-roles/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33786

NetBox CVE-2023-33786 is a stored XSS in the Create Circuit Types function (Name field) affecting NetBox v3.5.1. An attacker can inject a crafted payload to execute arbitrary web scripts or HTML. The connected records confirm the vulnerability description across multiple feeds; no exploitation st...

CVE-2023-33797

Summary: CVE-2023-33797 is a stored XSS vulnerability in NetBox v3.5.1 affecting the Create Sites endpoint (/dcim/sites/) where a crafted payload injected into the Name field can execute arbitrary scripts/HTML. Technical details in sources indicate NetBox 3.5.1 is affected; no explicit exploit co...

CVE-2023-33788

NetBox firmware: CVE-2023-33788 is a stored XSS in NetBox v3.5.1 affecting the Create Providers endpoint (/circuits/providers/) where a crafted payload in the Name field can execute scripts. The Red Hat, OSV, NVD, CVE lists describe the same issue; exploitation details are not provided in the doc...

CVE-2023-33795

NetBox 3.5.1 contains a stored XSS in the Create Contact Roles feature at /tenancy/contact-roles/, exploitable by injecting a crafted payload into the Name field. This could allow attackers to execute arbitrary web scripts or HTML in the context of a user session. The vulnerability is documented ...

NetBox 跨站脚本漏洞

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from a security issue in the Create Tenants /tenancy/tenants/ feature, and can b...

PT-2023-24499 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A vulnerability allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting them access to sensitive data stored in the database. However, the vendor disputes this,...

PT-2023-24492 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Contact Groups function, specifically at the /tenancy/contact-groups/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by...

PT-2023-24497 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Tenants function, specifically at the /tenancy/tenants/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a...