nautobot vulnerabilities (PyPI)
19 vulnerabilities.
-
nautobotPyPI Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs 6.4 Medium -
nautobotPyPI Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text 5.4 Medium -
nautobotPyPI Nautobot: GitRepository.current_head field should not be writable through REST API 7.1 High -
nautobotPyPI Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) 8.5 High -
nautobotPyPI Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) 6.5 Medium -
nautobotPyPI Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference 5.4 Medium -
nautobotPyPI Nautobot: Management of users via REST API does not apply configured password validators 2.7 Low -
nautobotPyPI Nautobot may allows uploaded media files to be accessible without authentication 6.3 Medium -
nautobotPyPI Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating 6.0 Medium -
nautobotPyPI Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects 6.3 Medium -
nautobotPyPI Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages 7.5 High -
nautobotPyPI Reflected Cross-site Scripting potential in all object list views in Nautobot 7.5 High -
nautobotPyPI Unauthenticated views may expose information to anonymous users 3.7 Low -
nautobotPyPI Nautobot has XSS potential in rendered Markdown fields 7.1 High -
nautobotPyPI Nautobot missing object-level permissions enforcement when running Job Buttons 3.5 Low -
nautobotPyPI Nautobot allows unauthenticated db-file-storage views 3.7 Low -
nautobotPyPI nautobot has XSS potential in custom links, job buttons, and computed fields 7.1 High -
nautobotPyPI Exposure of hashed user passwords via REST API in Nautobot 6.5 Medium -
nautobotPyPI Remote code execution in Jinja2 template rendering in Nautobot 7.5 High