https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:37:36 +0000 https://cve.radiocsirt.org/vuln/alsa-2022:7519 <p><strong>Affected:</strong> AlmaLinux:8: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)</p> <p>Security Fix(es):</p> <p>* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * grafana: XSS vulnerability in data source handling (CVE-2022-21702) * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703) * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)</p> <p>For more details about the security issue(s), including…</p> <p><strong>Affected:</strong> AlmaLinux:8: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB.</p> <p>The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)</p> <p>Security Fix(es):</p> <p>* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * grafana: XSS vulnerability in data source handling (CVE-2022-21702) * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703) * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)</p> <p>For more details about the security issue(s), including…</p> https://cve.radiocsirt.org/vuln/alsa-2022:7519 https://cve.radiocsirt.org/vuln/bdu:2023-02415 bdu:2023-02415 https://cve.radiocsirt.org/vuln/bdu:2023-02415 https://cve.radiocsirt.org/vuln/bit-grafana-2022-21702 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2022-21702 https://cve.radiocsirt.org/vuln/cnvd-2022-28802 cnvd-2022-28802 https://cve.radiocsirt.org/vuln/cnvd-2022-28802 https://cve.radiocsirt.org/vuln/euvd-2026-232801 EUVD-2026-232801 https://cve.radiocsirt.org/vuln/euvd-2026-232801 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21702 <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-21702 https://cve.radiocsirt.org/vuln/ghsa-xc3p-28hw-q24g <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana.</p> <p>Release v.8.3.5, only containing security fixes:</p> <p>- [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/)</p> <p>Release v.7.5.15, only containing security fixes:</p> <p>- [Download Grafana 7.5.15](https://grafana.com/grafana/download/7.5.15) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-15/)</p> <p>## XSS ([CVE-2022-21702](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21702))</p> <p>### Summary</p> <p>On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources.</p> <p>An attacker could serve HTML content through the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance.</p> <p>We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).</p> <p>### Impact</p> <p>Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same…</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana.</p> <p>Release v.8.3.5, only containing security fixes:</p> <p>- [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/)</p> <p>Release v.7.5.15, only containing security fixes:</p> <p>- [Download Grafana 7.5.15](https://grafana.com/grafana/download/7.5.15) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-15/)</p> <p>## XSS ([CVE-2022-21702](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21702))</p> <p>### Summary</p> <p>On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources.</p> <p>An attacker could serve HTML content through the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance.</p> <p>We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).</p> <p>### Impact</p> <p>Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same…</p> https://cve.radiocsirt.org/vuln/ghsa-xc3p-28hw-q24g https://cve.radiocsirt.org/vuln/gsd-2022-21702 gsd-2022-21702 https://cve.radiocsirt.org/vuln/gsd-2022-21702 https://cve.radiocsirt.org/vuln/oesa-2022-1599 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana, openEuler:20.03-LTS-SP3: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB and OpenTSDB.</p> <p>Security Fix(es):</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana, openEuler:20.03-LTS-SP3: grafana</p> <p>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB and OpenTSDB.</p> <p>Security Fix(es):</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known…</p> https://cve.radiocsirt.org/vuln/oesa-2022-1599 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11836-1 <p>grafana-8.3.5-1.1 on GA media</p> <p>grafana-8.3.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:11836-1 https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 <p>Feature update for grafana</p> <p>Feature update for grafana</p> https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21702 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21702 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0407 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Administratorrechte zu erlangen und um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Administratorrechte zu erlangen und um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0407