https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:50:40 +0000 https://cve.radiocsirt.org/vuln/cve-2024-29199 <p><strong>Affected:</strong> nautobot</p> <p>Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.</p> <p><strong>Affected:</strong> nautobot</p> <p>Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.</p> https://cve.radiocsirt.org/vuln/cve-2024-29199 https://cve.radiocsirt.org/vuln/ghsa-m732-wvh2-7cq4 <p><strong>Affected:</strong> PyPI: nautobot</p> <p>### Impact</p> <p>A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users, including the following:</p> <p>- `/api/graphql/` (1) - `/api/users/users/session/` (Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes are enabled on this Nautobot instance) - `/dcim/racks/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/dcim/devices/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/extras/job-results/&lt;uuid:pk&gt;/log-table/` - `/extras/secrets/provider/&lt;str:provider_slug&gt;/form/` (the only information exposed to an anonymous user is the fact that a secrets provider with the given slug (e.g. `environment-variable` or `text-file`) is supported by this Nautobot instance) - `/ipam/prefixes/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/ipam/ip-addresses/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/virtualization/clusters/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/virtualization/virtual-machines/&lt;uuid:pk&gt;/dynamic-groups/` (1)</p> <p>(1) These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable `EXEMPT_VIEW_PERMISSIONS` is changed from its default value (an empty list) to permit access to specific data by unauthenticated users.</p> <p>Of these endpoints, the only one that poses any significant risk of sensitive information disclosure under normal Nautobot operation with a default configuration is `/extras/job-results/&lt;uuid:pk&gt;/log-table/`. This endpoint returns an HTML table containing all of the log…</p> <p><strong>Affected:</strong> PyPI: nautobot</p> <p>### Impact</p> <p>A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users, including the following:</p> <p>- `/api/graphql/` (1) - `/api/users/users/session/` (Nautobot 2.x only; the only information exposed to an anonymous user is which authentication backend classes are enabled on this Nautobot instance) - `/dcim/racks/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/dcim/devices/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/extras/job-results/&lt;uuid:pk&gt;/log-table/` - `/extras/secrets/provider/&lt;str:provider_slug&gt;/form/` (the only information exposed to an anonymous user is the fact that a secrets provider with the given slug (e.g. `environment-variable` or `text-file`) is supported by this Nautobot instance) - `/ipam/prefixes/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/ipam/ip-addresses/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/virtualization/clusters/&lt;uuid:pk&gt;/dynamic-groups/` (1) - `/virtualization/virtual-machines/&lt;uuid:pk&gt;/dynamic-groups/` (1)</p> <p>(1) These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable `EXEMPT_VIEW_PERMISSIONS` is changed from its default value (an empty list) to permit access to specific data by unauthenticated users.</p> <p>Of these endpoints, the only one that poses any significant risk of sensitive information disclosure under normal Nautobot operation with a default configuration is `/extras/job-results/&lt;uuid:pk&gt;/log-table/`. This endpoint returns an HTML table containing all of the log…</p> https://cve.radiocsirt.org/vuln/ghsa-m732-wvh2-7cq4