CVE-2024-40734

NetBox

CVE-2024-40731

CVE-2024-40731 is an XSS vulnerability in NetBox v4.0.3. The issue arises from insufficient filtering/escaping of user-supplied data in the Name parameter of the endpoint /dcim/rear-ports/{id}/edit/, allowing injection of arbitrary HTML/JS in the affected web page. Several connected sources corro...

CVE-2024-38972

NetBox vulnerability CVE-2024-38972 is an XSS issue in version 4.0.3. The root cause is lack of proper filtering/escaping of user-supplied data in the Name parameter at the /dcim/power-ports/add/ endpoint, allowing injection of arbitrary HTML/script code. Affected product: NetBox v4.0.3 (DCIM/IPA...

CVE-2024-40731

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/id/edit/...

CVE-2024-40726: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/id/edit/...

CVE-2024-40739

NetBox v4.0.3 contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary HTML/script via the Name parameter on the /dcim/power-feeds/add page. Root cause appears to be insufficient input filtering/escaping of user-supplied data in that location (as reported by...

CVE-2024-40738

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/id/edit/...

CVE-2024-40735

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/id/edit/...

CVE-2024-40733

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/id/edit/...

CVE-2024-38972

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/...

CVE-2024-40740

A cross-site scripting (XSS) vulnerability exists in NetBox v4.0.3 due to the lack of effective filtering and escaping of user-supplied data in the Name parameter at the /dcim/power-feeds/{id}/edit/ location. An attacker can exploit this by injecting a crafted payload to execute arbitrary web scr...

CVE-2024-40726

The CVE-2024-40726 entry concerns NetBox v4.0.3 with a cross-site scripting (XSS) vulnerability exposed via the Name parameter in /dcim/power-ports/{id}/edit/. The Red Hat and CNVD/CNVD-style entries corroborate the same flaw. Root cause: lack of proper filtering/escaping of user-supplied data in...

LenelS2 NetBox Command Injection

The vulnerability of the LenelS2 NetBox access control and event monitoring system lies in the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and increase their...

LenelS2 NetBox Authentication Bypass

The vulnerability of the LenelS2 NetBox access control and event monitoring system lies in the use of strictly encrypted login credentials. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

LenelS2 NetBox Access Control Command Execution

The vulnerability of the LenelS2 NetBox access control and event monitoring system is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2024-2421

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions...

CVE-2024-2421

LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions...

CVE-2024-2422

LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands...

CVE-2024-2420

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements...

CVE-2024-2422

LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands...