Anhdq201

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Sites function, specifically at the /dcim/sites/ endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, as a temporary workaround, consider restricting access to the Create Sites function until a patch is available. Avoid using the `Name` field in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Circuit Types function, specifically at the /circuits/circuit-types/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Circuit Types function at the /circuits/circuit-types/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary web script or HTML execution. Avoid using the `Name` field in the Create Circuit Types function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Provider Accounts function, specifically at the /circuits/provider-accounts/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, as a temporary workaround, consider restricting access to the Create Provider Accounts function at the /circuits/provider-accounts/ API endpoint until a patch is available. Avoid using the `Name` field in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Contact Roles function, specifically at the /tenancy/contact-roles/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Contact Roles function until a patch is available to prevent exploitation of the stored XSS issue. Restrict access to the /tenancy/contact-roles/ API endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Contact Roles function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Regions function, specifically at the /dcim/regions/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, as a temporary workaround, consider restricting access to the Create Regions function at the /dcim/regions/ API endpoint until a patch is available. Avoid using the `Name` field in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Providers function, specifically at the /circuits/providers/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Providers function at the /circuits/providers/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Providers function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Tenant Groups function, specifically at the /tenancy/tenant-groups/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Tenant Groups function until a patch is available to prevent exploitation of the stored XSS issue. Restrict access to the /tenancy/tenant-groups/ API endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Tenant Groups function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Locations function, specifically at the /dcim/locations/ endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Locations function at the /dcim/locations/ endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Locations function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Power Panels function, specifically at the /dcim/power-panels/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Power Panels function until a patch is available to prevent exploitation. Restrict access to the /dcim/power-panels/ API endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the affected function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Tenants function, specifically at the /tenancy/tenants/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Tenants function until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the /tenancy/tenants/ API endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Tenants function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Rack function, specifically at the /dcim/rack/ endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Rack function until a patch is available to prevent exploitation of the stored XSS issue. Restrict access to the /dcim/rack/ endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Rack function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Contacts function, specifically at the /tenancy/contacts/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Contacts function at the /tenancy/contacts/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Contacts function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Site Groups function, specifically at the /dcim/site-groups/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Site Groups function at the /dcim/site-groups/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Site Groups function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Contact Groups function, specifically at the /tenancy/contact-groups/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Contact Groups function at the /tenancy/contact-groups/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Contact Groups function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netbox version 3.5.1 **Description** A stored cross-site scripting (XSS) issue exists in the Create Rack Roles function, specifically at the /dcim/rack-roles/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `Name` field. **Recommendations** For Netbox version 3.5.1, consider disabling the Create Rack Roles function at the /dcim/rack-roles/ API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary script execution. Avoid using the `Name` field in the Create Rack Roles function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Rukovoditel version 3.2.1 **Description** A stored cross-site scripting (XSS) issue was found in the Add New Field function at "/index.php?module=entities/fields&entities id=24". This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Short Name` field. **Recommendations** For Rukovoditel version 3.2.1, consider disabling the Add New Field function at "/index.php?module=entities/fields&entities id=24" until a patch is available. Restrict access to the `Short Name` field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rukovoditel version 3.2.1 **Description** The issue is related to a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at "/index.php?module=entities/entities groups". This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Name` field after clicking "Add". **Recommendations** For Rukovoditel version 3.2.1, consider disabling the Entities Group feature at "/index.php?module=entities/entities groups" until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the `Name` field in the Entities Group feature to minimize the risk of arbitrary web script or HTML execution.

**Name of the Vulnerable Software and Affected Versions** webtareas version 2.4p5 **Description** A cross-site scripting (XSS) issue was found in the /general/search.php?searchtype=simple component. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Search` field. **Recommendations** For webtareas version 2.4p5, as a temporary workaround, consider restricting access to the /general/search.php?searchtype=simple endpoint until a patch is available. Avoid using the `Search` field in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rukovoditel version 3.2.1 **Description** A stored cross-site scripting (XSS) issue was found in the Highlight Row feature at "/index.php?module=entities/listing types&entities id=24". This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Note` field after clicking "Add". **Recommendations** For Rukovoditel version 3.2.1, as a temporary workaround, consider disabling the Highlight Row feature until a patch is available. Restrict access to the "/index.php?module=entities/listing types&entities id=24" endpoint to minimize the risk of exploitation. Avoid using the `Note` field in the affected feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rukovoditel version 3.2.1 **Description** The issue is related to a stored cross-site scripting (XSS) vulnerability in the Add Page function at "/index.php?module=help pages/pages&entities id=24". This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Title` field. **Recommendations** For Rukovoditel version 3.2.1, consider disabling the Add Page function at "/index.php?module=help pages/pages&entities id=24" until a patch is available. Restrict access to the Title field in the Add Page function to minimize the risk of exploitation. Avoid using the `Title` field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.