Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,096 results · page 16 of 22
Jul 27, 2022A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-speCVE-2022-36883 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
- Product
- Jenkins Git Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacCVE-2022-36882 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
- Product
- Jenkins Git Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 25, 2022Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.CVE-2022-36450 · Other software · Obsidian · reported by MITREHigh 8
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.obsidian.mdchtsecurity.com
Jul 22, 2022Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscureCVE-2022-1138 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 15, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-31107 · Other software · grafana · reported by GitHubHigh 7.1
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Gra
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-31097 · Other software · grafana · reported by GitHubHigh 7.3
Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Azure Storage Library Information Disclosure VulnerabilityCVE-2022-30187 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Azure Storage Library Information Disclosure Vulnerability
- Product
- Azure Storage Blobs client library for .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2022Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy VulnCVE-2020-35168 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
- Product
- Dell BSAFE Crypto-C Micro Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy VulnCVE-2020-35167 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
- Product
- Dell BSAFE Crypto-C Micro Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy VulnCVE-2020-35166 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
- Product
- BSAFE Crypto-C Micro Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy VulnCVE-2020-35164 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
- Product
- Dell BSAFE Crypto-C Micro Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy VuCVE-2020-29506 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.
- Product
- Dell BSAFE Crypto-C Micro Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a CVE-2022-2227 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.CVE-2022-34817 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
- Product
- Jenkins Failed Job Deactivator Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an iCVE-2022-34174 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid CVE-2022-31248 · Other software · SUSE · reported by meissner@suse.deMedium 5.3
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.
- Product
- SUSE Manager Server 4.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Jun 15, 2022Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure vCVE-2022-24436 · Other software · Intel · reported by secure@intel.comMedium 6.5
Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access.
- Product
- *
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Jun 15, 2022A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data.CVE-2022-1342 · Other software · Devolutions · reported by security@devolutions.netMedium 4.6
A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sensitive fields to sometimes stay revealed when closing and reopening a panel, which could lead to involuntarily disclosing sensitive information. This issue affects: Devolutions Remote Desktop Manager 2022.1.24 version and prior versions.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 8, 2022As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filCVE-2022-32273 · Other software · Opswat · reported by MITREMedium 4.3
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.
- Product
- Metadefender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comopswat.com
Jun 5, 2022The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used.CVE-2022-32296 · Other software · Siemens · reported by MITRELow 3.3
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarxiv.orgcdn.kernel.org
May 20, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-29170 · Other software · grafana · reported by GitHubMedium 6.6
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.CVE-2021-33149 · Other software · Intel · reported by secure@intel.comMedium 5.5
Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
- Product
- Core Processors Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
May 11, 2022AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memorCVE-2021-26400 · Other software · AMD · reported by psirt@amd.comMedium 4
AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2022-29164 · Other software · argoproj · reported by GitHubHigh 7.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-24812 · Other software · grafana · reported by GitHubHigh 8
Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests. This can lead to an escalation of privileges, when for example a first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin, essentially accessing higher privilege than it should. The vulnerability is only impacting Grafana Enterprise when the fine-grained access control beta feature is enabled and there are more than one API Keys in one organization with different roles assigned. All installations after Grafana Enterprise v8.1.0-beta1 should be upgraded as soon as possible. As an alternative, disable fine-grained access control will mitigate the vulnerability.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32157 · Other software · Webmin · reported by MITRECritical 9.6
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32156 · Other software · Webmin · reported by MITREHigh 8.8
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability.CVE-2022-26851 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to data loss.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attemptCVE-2022-22356 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487.
- Product
- MQ Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 4, 2022There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.CVE-2022-1168 · WordPress plugins & themes · reported by WPScanMedium 6.1
There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
- Product
- JobSearch WP JobSearch
- Fixed in
- 1.5.1
- What to do
- Update JobSearch WP JobSearch to 1.5.1 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Apr 1, 2022It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using sCVE-2019-14839 · Other software · Redhat · reported by Red HatHigh 7.5
It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc.
- Product
- Business-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 21, 2022Amelia: Stores image blobs into actual files whose extension is controlled by the userCVE-2022-0687 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 15, 2022Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerabiliCVE-2022-27196 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
- Product
- Jenkins Favorite Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 28, 2022HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage.CVE-2022-24685 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Feb 14, 2022Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.CVE-2022-0569 · Other software · snipe · reported by security@huntr.devMedium 5.3
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor.CVE-2021-4035 · Other software · A3Sec · reported by cve-coordination@incibe.esLow 3.5
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
- Product
- Wocu Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-21713 · Other software · grafana · reported by GitHubMedium 4.3
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-21703 · Other software · grafana · reported by GitHubMedium 6.3
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-21702 · Other software · grafana · reported by GitHubMedium 6.5
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attack
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an unauCVE-2021-39021 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which could facilitate username enumeration. IBM X-Force ID: 213856.
- Product
- Security Guardium Data Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 18, 2022Grafana is an open-source platform for monitoring and observability.CVE-2022-21673 · Other software · grafana · reported by GitHubMedium 4.3
Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature.CVE-2022-22120 · Other software · nocodb · reported by vulnerabilitylab@mend.ioMedium 5.3
In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
- Product
- nocodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jan 3, 2022ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI.CVE-2021-20147 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 5.3
ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 10, 2021Grafana is an open-source platform for monitoring and observability.CVE-2021-43815 · Other software · grafana · reported by GitHubMedium 4.3
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 10, 2021Grafana is an open-source platform for monitoring and observability.CVE-2021-43813 · Other software · grafana · reported by GitHubMedium 4.3
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 8, 2021Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack.CVE-2021-41090 · Other software · grafana · reported by GitHubMedium 6.5
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defined in the base YAML file are exposed at `/-/config` and metrics instance configs defined for the scraping service are exposed at `/agent/api/v1/configs/:key`. Inline secrets will be exposed to anyone being able to reach these endpoints. If HTTPS with client authentication is not configured, these endpoints are accessible to unauthenticated users. Secrets found in these sections are used for delivering metrics to a Prometheus Remote Write system, authenticating against a system for discovering Prometheus targets, and authenticating against a system for collecting metrics. This does not apply for non-inlined secrets, such as `*_file` based secrets. This issue is patched in Grafana Agent versions 0.20.1 and 0.21.2. A few workarounds are available. Users who cannot upgrade should use non-inline secrets where possible. Users may also desire to restrict API access to Grafana Agent with some combi
- Product
- agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021Grafana is an open-source platform for monitoring and observability.CVE-2021-41244 · Other software · grafana · reported by GitHubCritical 9.1
Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Nov 10, 2021An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3.CVE-2021-43561 · Other software · Pega-sus · reported by MITREMedium 5.4
An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
- Product
- Google For Jobs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.CVE-2021-42057 · Other software · Obsidian · reported by MITREHigh 7.8
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases.
- Product
- Obsidian Dataview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2021Grafana is an open-source platform for monitoring and observability.CVE-2021-41174 · Other software · grafana · reported by GitHubMedium 6.9
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.