https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:01:25 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-08254 bdu:2024-08254 https://cve.radiocsirt.org/vuln/bdu:2024-08254 https://cve.radiocsirt.org/vuln/bit-grafana-2024-9264 <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> <p><strong>Affected:</strong> Bitnami: grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> https://cve.radiocsirt.org/vuln/bit-grafana-2024-9264 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0899 certfr-2024-avi-0899 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0899 https://cve.radiocsirt.org/vuln/euvd-2026-222719 EUVD-2026-222719 https://cve.radiocsirt.org/vuln/euvd-2026-222719 https://cve.radiocsirt.org/vuln/fkie_cve-2024-9264 <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-9264 https://cve.radiocsirt.org/vuln/ghsa-q99m-qcv4-fpm7 <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> <p><strong>Affected:</strong> Go: github.com/grafana/grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> https://cve.radiocsirt.org/vuln/ghsa-q99m-qcv4-fpm7 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0350-1 <p>Security update for govulncheck-vulndb</p> <p>Security update for govulncheck-vulndb</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:0350-1 https://cve.radiocsirt.org/vuln/suse-su-2024:3911-1 <p>Security update for govulncheck-vulndb</p> <p>Security update for govulncheck-vulndb</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3911-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-9264 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: grafana</p> <p>The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana&#39;s $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-9264 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3238 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3238