https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:30:21 +0000 https://cve.radiocsirt.org/vuln/alsa-2022:1781 <p><strong>Affected:</strong> AlmaLinux:8: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>The following packages have been upgraded to a later upstream version: grafana (7.5.11). (BZ#1993214)</p> <p>Security Fix(es):</p> <p>* grafana: directory traversal vulnerability (CVE-2021-43813)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>The following packages have been upgraded to a later upstream version: grafana (7.5.11). (BZ#1993214)</p> <p>Security Fix(es):</p> <p>* grafana: directory traversal vulnerability (CVE-2021-43813)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2022:1781 https://cve.radiocsirt.org/vuln/bit-grafana-2021-43813 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2021-43813 https://cve.radiocsirt.org/vuln/euvd-2026-32680 EUVD-2026-32680 https://cve.radiocsirt.org/vuln/euvd-2026-32680 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43813 <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43813 https://cve.radiocsirt.org/vuln/gsd-2021-43813 gsd-2021-43813 https://cve.radiocsirt.org/vuln/gsd-2021-43813 https://cve.radiocsirt.org/vuln/oesa-2021-1470 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana</p> <p>Metrics dashboard and graph editor. Security Fix(es): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.(CVE-2021-43813)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana</p> <p>Metrics dashboard and graph editor. Security Fix(es): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.(CVE-2021-43813)</p> https://cve.radiocsirt.org/vuln/oesa-2021-1470 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0140-1 <p>Security update for grafana</p> <p>Security update for grafana</p> https://cve.radiocsirt.org/vuln/opensuse-su-2022:0140-1 https://cve.radiocsirt.org/vuln/rhsa-2022:0056 <p>gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation nodejs-axios: Regular expression denial of service in trim function grafana: Snapshot authentication bypass golang: archive/zip: Reader.Open panics on empty string grafana: directory traversal vulnerability golang: net/http: limit growth of header canonicalization cache golang: syscall: don&#39;t close fd 0 on ForkExec error grafana: Forward OAuth Identity Token can allow users to access some data sources</p> <p>gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation nodejs-axios: Regular expression denial of service in trim function grafana: Snapshot authentication bypass golang: archive/zip: Reader.Open panics on empty string grafana: directory traversal vulnerability golang: net/http: limit growth of header canonicalization cache golang: syscall: don&#39;t close fd 0 on ForkExec error grafana: Forward OAuth Identity Token can allow users to access some data sources</p> https://cve.radiocsirt.org/vuln/rhsa-2022:0056 https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 <p>Feature update for grafana</p> <p>Feature update for grafana</p> https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43813 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43813 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0405 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0405