UBUNTU-CVE-2022-23498

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the...

Session fixation

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the...

CVE-2022-23498 When query caching is enabled in Grafana users can query another users session

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the...

PT-2023-1578 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 9.2.10 Grafana versions prior to 9.3.4 Description: The issue is related to the caching of datasource queries in Grafana, which includes caching of the grafana session header. This allows any user querying a datasour...

Grafana 8.3.0 < 9.2.10, 9.3.0 < 9.3.4 Information Disclosure Vulnerability (GHSA-2j8f-6whh-frc8)

Grafana is prone to an information disclosure vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

CVE-2023-0569 Weak Password Requirements in publify/publify

Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10...

CVE-2023-0569 Weak Password Requirements in publify/publify

Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10...

Publify 安全漏洞

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions prior to 9.2.10, which stems from allowing users to log in with weak passwords...

Stored XSS in ResourcePicker component

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren’t properly...

Integer Overflow or Wraparound

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Integer Overflow or Wraparound in app/models/user.rb, which allows attackers to cause denial of service by supplying an excessively long name value fo...

Information Exposure

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Information Exposure in resourceuploader.rb, which exposes EXIF image metadata to all users when a file is uploaded. Remediation Upgrade publifycore t...

CVE-2022-1812

Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10...

Integer overflow

Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10...

CVE-2022-2815 Insecure Storage of Sensitive Information in publify/publify

Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10...

PT-2023-12937 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify/publify versions prior to 9.2.10 Description: The issue concerns insecure storage of sensitive information in the GitHub repository publify/publify. Recommendations: For versions prior to 9.2.10, update to version 9.2.10 or later to...

Publify 输入验证错误漏洞

Publify is a simple but full-featured web publishing software. versions of Publify prior to 9.2.10 contain an input validation error vulnerability that stems from the fact that it allows the insertion of large characters "title name and post field" into the input field of an article field, allowi...