Grafana Code Issues Vulnerabilities

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A remote code execution vulnerability exists in the avatar feature in Grafana versions...

PT-2020-5961 · Grafana +4 · Grafana +4

Name of the Vulnerable Software and Affected Versions: Grafana versions 3.0.1 through 7.0.1 Description: The avatar feature in Grafana has an SSRF Incorrect Access Control issue, allowing any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the...

Hardcoded credentials

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511...

CVE-2019-4675

CVE-2019-4675 affects IBM Security Identity Manager 7.0.1, where the component contains hard-coded credentials used for its own inbound authentication, outbound communication to external components, or encryption of internal data. The root cause is the presence of embedded credentials in ISIM ver...

CVE-2019-4674

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

CVE-2019-4674

CVE-2019-4674 affects IBM Security Identity Manager 7.0.1, where a remote attacker could traverse directories by sending a URL with dot-dot (../) sequences to view arbitrary files. The vulnerability is a directory traversal in ISIM, enabling partial confidentiality impact. IBM’s related advisory ...

Information disclosure in the listEntityLinks servlet resource of the Application links plugin - CVE-2019-15011

The version of the Application Links plugin used in Confluence before version 6.13.6, from version 6.14.0 before version 6.15.5, and from version 7.0.0 before 7.0.1 allows remote attackers to obtain information about configured application links via a missing permissions check. See...

CVE-2018-1968

CVE-2018-1968 affects IBM Security Identity Manager (ISIM) 7.0.1, where an information-disclosure flaw allows unauthorized users to access sensitive data, potentially enabling further attacks. The description and connected sources confirm the vulnerable component is ISIM (VM/Vendor: IBM) with imp...

IBM Security Identity Manager Information Disclosure Vulnerability (CNVD-2019-25734)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

Cross site scripting

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2019-5417

A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server...

CVE-2019-5417

A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server...

Path traversal

A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server...

CVE-2018-1970

CVE-2018-1970 affects IBM Security Identity Manager 7.0.1, where XML External Entity (XXE) processing vulnerability exists when handling XML data. The underling issue is improper XML parsing that allows an attacker to disclose sensitive information or exhaust memory resources. Affected product: I...

CVE-2018-1959

IBM Security Identity Manager Virtual Appliance 7.0.1 is affected by CVE-2018-1959 due to hard-coded credentials used for inbound authentication/outbound communication or data encryption. Affected versions: 7.0.1 – 7.0.1.10. Impact per IBM: Confidentiality impact high; other impacts not reported....

CVE-2018-6668 Bypass Application Control with simple DLL

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell...

McAfee Application and Change Control Security Bypass Vulnerability

McAfee Application and Change Control is a suite of program control software from the U.S.-based McAfee. The software protects enterprise servers and endpoints from unauthorized applications and malware threats by using a dynamic trust model. A security bypass vulnerability exists in McAfee...

Dell RSA Identity Governance and Lifecycle Cross-Site Scripting Vulnerability

Dell RSA Identity Lifecycle and Governance is a suite of identity governance and lifecycle management solutions from Dell USA. The product includes features such as access authentication, configuration automation and role management. A cross-site scripting vulnerability exists in Dell RSA Identit...

Security Bulletin: IBM Security Identity Manager has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following fixpack for IBM Security Identity Manager in response to CVE-2017-5753 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5754 Affected Products and Versions IBM Security Identity Manager ISIM 7.0.0, 7.0.1 Remediation/Fixes Product...

Security Bulletin: Vulnerabilities in IBM® Java™ Runtime affect WebSphere Dashboard Framework (CVE-2016-5573, CVE-2016-5597)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Version 6 that is used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in October 2016. The vulnerabilities may affect some configurations of products bundled with WebSphere...