Page 5 of 40 results (0.007 seconds)

CVSS: 10.0EPSS: 1%CPEs: 10EXPL: 1

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se presenta una vulnerabilidad de verificación de firmas en crewjam/saml. Este fallo permite a un atacante omitir la autenticación SAML. • https://bugzilla.redhat.com/show_bug.cgi?id=1907670 https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9 https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM https://mattermos • CWE-115: Misinterpretation of Input •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. Grafana versiones anteriores a 7.1.0-beta 1, permite un ataque de tipo XSS por medio de un alias de consulta de la fuente de datos de ElasticSearch A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed. • https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01 https://github.com/grafana/grafana/pull/25401 https://security.netapp.com/advisory/ntap-20201123-0002 https://access.redhat.com/security/cve/CVE-2020-24303 https://bugzilla.redhat.com/show_bug.cgi?id=1892418 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations. Grafana versiones anteriores a 6.4.3 incluyéndola, presenta una vulnerabilidad de Lectura Arbitraria de Archivos, que podría ser explotada por un atacante autenticado que tiene privilegios para modificar las configuraciones de la fuente de datos Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations. • https://security.netapp.com/advisory/ntap-20200918-0003 https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read https://access.redhat.com/security/cve/CVE-2019-19499 https://bugzilla.redhat.com/show_bug.cgi?id=1873615 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. Grafana hasta la versión 6.7.1 permite un ataque de tipo XSS almacenado debido a la insuficiente protección de entrada en el campo originalUrl, lo que permite a un atacante inyectar código JavaScript que se ejecutará después de hacer clic en Open Original Dashboard después de visitar la instantánea A flaw was found in grafana. The lack of URL sanitizing allows for stored XSS. • https://github.com/AVE-Stoik/CVE-2020-11110-Proof-of-Concept https://github.com/grafana/grafana/blob/master/CHANGELOG.md https://security.netapp.com/advisory/ntap-20200810-0002 https://access.redhat.com/security/cve/CVE-2020-11110 https://bugzilla.redhat.com/show_bug.cgi?id=1861044 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.2EPSS: 69%CPEs: 7EXPL: 4

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. La funcionalidad avatar en Grafana versiones 3.0.1 hasta 7.0.1, presenta un problema de Control de Acceso Incorrecto de tipo SSRF. • https://www.exploit-db.com/exploits/48638 http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.html http://www.openwall.com/lists/oss-security/2020/06/03/4 http://www. • CWE-476: NULL Pointer Dereference CWE-918: Server-Side Request Forgery (SSRF) •