CVE-2024-40734

NetBox

NetBox 安全漏洞

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...

CVE-2024-40731

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/id/edit/...

CVE-2024-40737

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add...

CVE-2024-40732

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/...

CVE-2024-40729

NetBox v4.0.3 is affected by a cross-site scripting (XSS) vulnerability in the Name parameter of the /dcim/interfaces/add/ form. The vulnerability arises from insufficient filtering/escaping of user input, allowing an attacker to inject arbitrary HTML/JS into the page. Documents consistently iden...

CVE-2024-40736

NetBox v4.0.3 is affected by an XSS vulnerability in the /dcim/power-outlets/add endpoint where user-supplied data in the Name parameter can be used to inject arbitrary HTML/JS. The root cause is insufficient filtering/escaping of input in that field, enabling attacker-controlled payloads to exec...

CVE-2024-40731

CVE-2024-40731 is an XSS vulnerability in NetBox v4.0.3. The issue arises from insufficient filtering/escaping of user-supplied data in the Name parameter of the endpoint /dcim/rear-ports/{id}/edit/, allowing injection of arbitrary HTML/JS in the affected web page. Several connected sources corro...

CVE-2024-40730

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/id/edit/...

CVE-2024-40739

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add...

CVE-2024-40729

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/...

CVE-2024-40738

Summary: CVE-2024-40738 is a cross-site scripting (XSS) vulnerability affecting NetBox v4.0.3. The issue arises from lack of proper filtering/escaping of user-supplied data in the Name parameter at the URL path /dcim/console-ports/{id}/edit/, allowing an attacker to inject arbitrary HTML/JS. Docu...

CVE-2024-40734

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/...

CVE-2024-40732

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/...

CVE-2023-50244

Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This...

Ecommerce-CodeIgniter-Bootstrap Cross-Site Scripting Vulnerability

Ecommerce-CodeIgniter-Bootstrap is a responsive, multi-vendor, multi-language online store platform shopping cart solution. Ecommerce-CodeIgniter-Bootstrap suffers from a cross-site scripting vulnerability that stems from cross-site scripting vulnerabilities in the searchtitle, catName, sub, name...

The vulnerability of the New Activity Handler component in the virtual learning environment Moodle, which allows a perpetrator to execute arbitrary code.

The vulnerability of the New Activity Handler component in the virtual learning environment Moodle is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through the Field Name...

WordPress Gallery Blocks with Lightbox plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via galleryID and className Parameters vulnerability discovered by Webbernaut in WordPress Plugin SimpLy Gallery versions = 3.2.1...

The vulnerability of the /view/userAuthentication/SSO/commit.php file in the Ruijie RG-UAC router software allows a perpetrator to execute arbitrary commands.

The vulnerability of the /view/userAuthentication/SSO/commit.php file in the Ruijie RG-UAC router microprogramming system exists due to the failure to implement measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to...

Cross-site Scripting (XSS)

moodle/moodle is vulnerable to Cross-site Scripting XSS. The vulnerability is caused due to improper validation of user input in the "Field Name" parameter associated with a new activity, which allows an attacker to perform XSS attacks...