Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Grafana
(Grafana)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 66 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2020-06-02 | CVE-2018-18625 | Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. | Grafana | N/A | ||
2020-06-02 | CVE-2018-18624 | Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. | Grafana | N/A | ||
2020-04-27 | CVE-2020-12052 | Grafana version < 6.7.3 is vulnerable for annotation popup XSS. | Grafana | N/A | ||
2018-12-13 | CVE-2018-19039 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. | Grafana, Active_iq_performance_analytics_services, Storagegrid_webscale_nas_bridge, Ceph_storage, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation | 6.5 | ||
2018-12-13 | CVE-2018-19039 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. | Grafana, Active_iq_performance_analytics_services, Storagegrid_webscale_nas_bridge, Ceph_storage, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation | 6.5 | ||
2018-06-11 | CVE-2018-12099 | Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. | Grafana, Active_iq_performance_analytics_services, Storagegrid_webscale_nas_bridge | 6.1 | ||
2018-08-29 | CVE-2018-15727 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. | Grafana, Ceph_storage | 9.8 | ||
2018-12-20 | CVE-2018-1000816 | Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted.. | Grafana | 5.4 |