https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:16:13 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-01605 bdu:2023-01605 https://cve.radiocsirt.org/vuln/bdu:2023-01605 https://cve.radiocsirt.org/vuln/bit-grafana-2023-0507 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2023-0507 https://cve.radiocsirt.org/vuln/euvd-2026-266785 EUVD-2026-266785 https://cve.radiocsirt.org/vuln/euvd-2026-266785 https://cve.radiocsirt.org/vuln/fkie_cve-2023-0507 <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> <p>Grafana is an open-source platform for monitoring and observability.</p> <p>Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.</p> <p>The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.</p> <p>An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript.</p> <p>This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.</p> <p>Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-0507 https://cve.radiocsirt.org/vuln/ghsa-hjv9-hm2f-rpcj <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> https://cve.radiocsirt.org/vuln/ghsa-hjv9-hm2f-rpcj https://cve.radiocsirt.org/vuln/gsd-2023-0507 gsd-2023-0507 https://cve.radiocsirt.org/vuln/gsd-2023-0507 https://cve.radiocsirt.org/vuln/rhsa-2024:0746 <p>grafana: Use of Cache Containing Sensitive Information golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests haproxy: segfault DoS grafana: cross site scripting grafana: cross site scripting grafana: JWT token leak to data source grafana: stored XSS vulnerability affecting the core plugin &#34;Text&#34; golang: html/template: backticks not treated as string delimiters haproxy: request smuggling attack in HTTP/1 header parsing</p> <p>grafana: Use of Cache Containing Sensitive Information golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests haproxy: segfault DoS grafana: cross site scripting grafana: cross site scripting grafana: JWT token leak to data source grafana: stored XSS vulnerability affecting the core plugin &#34;Text&#34; golang: html/template: backticks not treated as string delimiters haproxy: request smuggling attack in HTTP/1 header parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0746 https://cve.radiocsirt.org/vuln/suse-su-2023:1902-1 <p>Security update for SUSE Manager Client Tools</p> <p>Security update for SUSE Manager Client Tools</p> https://cve.radiocsirt.org/vuln/suse-su-2023:1902-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-0507 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren&#39;t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-0507 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0528 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0528