Racktables
Monthly
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.