rpm package
suse/grafana&distro=SUSE Manager Client Tools 15
pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2015
Vulnerabilities (99)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-11741 | Med | 4.3 | < 10.4.15-150000.1.71.1 | 10.4.15-150000.1.71.1 | Jan 31, 2025 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15 | |
| CVE-2024-45339 | Hig | 7.1 | < 10.4.15-150000.1.71.1 | 10.4.15-150000.1.71.1 | Jan 28, 2025 | When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and | |
| CVE-2025-21613 | — | < 10.4.15-150000.1.71.1 | 10.4.15-150000.1.71.1 | Jan 6, 2025 | go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flag | ||
| CVE-2024-45337 | Cri | 9.1 | < 10.4.13-150000.1.66.1 | 10.4.13-150000.1.66.1 | Dec 12, 2024 | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that | |
| CVE-2024-22037 | Med | 5.5 | < 10.4.13-150000.1.66.1 | 10.4.13-150000.1.66.1 | Nov 28, 2024 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users. | |
| CVE-2024-9476 | Med | — | < 11.5.5-150000.1.79.1 | 11.5.5-150000.1.79.1 | Nov 13, 2024 | A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utiliz | |
| CVE-2024-51744 | Low | 3.1 | < 10.4.13-150000.1.66.1 | 10.4.13-150000.1.66.1 | Nov 4, 2024 | golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors r | |
| CVE-2024-9264 | — | < 11.5.5-150000.1.79.1 | 11.5.5-150000.1.79.1 | Oct 18, 2024 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit | ||
| CVE-2024-8118 | Med | — | < 10.4.13-150000.1.66.1 | 10.4.13-150000.1.66.1 | Sep 26, 2024 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. | |
| CVE-2023-45288 | Hig | 7.5 | < 11.5.5-150000.1.79.1 | 11.5.5-150000.1.79.1 | Apr 4, 2024 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma | |
| CVE-2024-1313 | Med | 6.5 | < 9.5.18-150000.1.63.2 | 9.5.18-150000.1.63.2 | Mar 26, 2024 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the per | |
| CVE-2024-28180 | — | < 10.4.15-150000.1.71.1 | 10.4.15-150000.1.71.1 | Mar 9, 2024 | Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now ret | ||
| CVE-2023-6152 | — | < 9.5.18-150000.1.63.2 | 9.5.18-150000.1.63.2 | Feb 13, 2024 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | ||
| CVE-2024-0690 | — | < 9.5.18-150000.1.63.2 | 9.5.18-150000.1.63.2 | Feb 6, 2024 | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive infor | ||
| CVE-2023-5764 | — | < 9.5.18-150000.1.63.2 | 9.5.18-150000.1.63.2 | Dec 12, 2023 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templa | ||
| CVE-2023-29409 | — | < 9.5.5-150000.1.54.3 | 9.5.5-150000.1.54.3 | Aug 2, 2023 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr | ||
| CVE-2023-3128 | — | < 9.5.5-150000.1.51.1 | 9.5.5-150000.1.51.1 | Jun 22, 2023 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. | ||
| CVE-2023-2183 | — | < 9.5.5-150000.1.51.1 | 9.5.5-150000.1.51.1 | Jun 6, 2023 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does | ||
| CVE-2023-2801 | — | < 9.5.5-150000.1.51.1 | 9.5.5-150000.1.51.1 | Jun 6, 2023 | Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the | ||
| CVE-2023-1387 | — | < 9.5.1-150000.1.48.5 | 9.5.1-150000.1.48.5 | Apr 26, 2023 | Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option |
- affected < 10.4.15-150000.1.71.1fixed 10.4.15-150000.1.71.1
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15
- affected < 10.4.15-150000.1.71.1fixed 10.4.15-150000.1.71.1
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and
- CVE-2025-21613Jan 6, 2025affected < 10.4.15-150000.1.71.1fixed 10.4.15-150000.1.71.1
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flag
- affected < 10.4.13-150000.1.66.1fixed 10.4.13-150000.1.66.1
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that
- affected < 10.4.13-150000.1.66.1fixed 10.4.13-150000.1.66.1
The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.
- affected < 11.5.5-150000.1.79.1fixed 11.5.5-150000.1.79.1
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utiliz
- affected < 10.4.13-150000.1.66.1fixed 10.4.13-150000.1.66.1
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors r
- CVE-2024-9264Oct 18, 2024affected < 11.5.5-150000.1.79.1fixed 11.5.5-150000.1.79.1
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit
- affected < 10.4.13-150000.1.66.1fixed 10.4.13-150000.1.66.1
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- affected < 11.5.5-150000.1.79.1fixed 11.5.5-150000.1.79.1
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma
- affected < 9.5.18-150000.1.63.2fixed 9.5.18-150000.1.63.2
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the per
- CVE-2024-28180Mar 9, 2024affected < 10.4.15-150000.1.71.1fixed 10.4.15-150000.1.71.1
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now ret
- CVE-2023-6152Feb 13, 2024affected < 9.5.18-150000.1.63.2fixed 9.5.18-150000.1.63.2
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
- CVE-2024-0690Feb 6, 2024affected < 9.5.18-150000.1.63.2fixed 9.5.18-150000.1.63.2
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive infor
- CVE-2023-5764Dec 12, 2023affected < 9.5.18-150000.1.63.2fixed 9.5.18-150000.1.63.2
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templa
- CVE-2023-29409Aug 2, 2023affected < 9.5.5-150000.1.54.3fixed 9.5.5-150000.1.54.3
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr
- CVE-2023-3128Jun 22, 2023affected < 9.5.5-150000.1.51.1fixed 9.5.5-150000.1.51.1
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- CVE-2023-2183Jun 6, 2023affected < 9.5.5-150000.1.51.1fixed 9.5.5-150000.1.51.1
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does
- CVE-2023-2801Jun 6, 2023affected < 9.5.5-150000.1.51.1fixed 9.5.5-150000.1.51.1
Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the
- CVE-2023-1387Apr 26, 2023affected < 9.5.1-150000.1.48.5fixed 9.5.1-150000.1.48.5
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option
Page 2 of 5