FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
4e60d660-6298-11ed-9ca2-6c3be5272acdGrafana -- Plugin signature bypass

Grafana Labs reports:

On July 4th as a result of an internal security audit we have discovered a bypass in the plugin signature verification by exploiting a versioning flaw.

We believe that this vulnerability is rated at CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).


Discovery 2022-07-04
Entry 2022-11-12
grafana
ge 7.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-31123
https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8
909a80ba-6294-11ed-9ca2-6c3be5272acdGrafana -- Improper authentication

Grafana Labs reports:

On September 7, as a result of an internal security audit, we discovered a security vulnerability in Grafana’s basic authentication related to the usage of username and email address.

n Grafana, a user’s username and email address are unique fields, which means no other user can have the same username or email address as another user.

In addition, a user can have an email address as a username, and the Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where user_1 can register with one email address and user_2 can register their username as user_1’s email address. As a result, user_1 would be prevented from signing in to Grafana, since user_1 password won’t match with user_2 email address.

The CVSS score for this vulnerability is 4.3 moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).


Discovery 2022-09-07
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-39229
https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r
6eb6a442-629a-11ed-9ca2-6c3be5272acdGrafana -- Privilege escalation

Grafana Labs reports:

Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization.

The CVSS score for this vulnerability is 6.4 Moderate


Discovery 2022-10-24
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.15

ge 9.0.0 lt 9.2.4

grafana8
ge 8.0.0 lt 8.5.15

grafana9
ge 9.0.0 lt 9.2.4

CVE-2022-39306
https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84
0a80f159-629b-11ed-9ca2-6c3be5272acdGrafana -- Username enumeration

Grafana Labs reports:

When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message.

The CVSS score for this vulnerability is 5.3 Moderate


Discovery 2022-10-24
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.15

ge 9.0.0 lt 9.2.4

grafana8
ge 8.0.0 lt 8.5.15

grafana9
ge 9.0.0 lt 9.2.4

CVE-2022-39307
https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
6f6c9420-6297-11ed-9ca2-6c3be5272acdGrafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports:

On June 26 a security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis the vulnerability impacts data source and plugin proxy endpoints with authentication tokens but under some conditions.

We believe that this vulnerability is rated at CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)


Discovery 2022-06-26
Entry 2022-11-12
grafana
ge 7.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-31130
https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc
6877e164-6296-11ed-9ca2-6c3be5272acdGrafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports:

On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions.

We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)


Discovery 2022-09-07
Entry 2022-11-12
grafana
ge 5.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-39201
https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr