Token Leakage in Proxy in Grafana

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

The vulnerability of the WebDriver driver for the Mozilla Firefox browser allows a hacker to disclose protected information and execute arbitrary code.

The vulnerability of the WebDriver driver for the Mozilla Firefox browser is related to a lack of mechanisms for verifying the data source. Exploiting this vulnerability allows a malicious actor, operating remotely, to circumvent established security restrictions, disclose sensitive information,...

Dairy Farm Shop Management System SQL注入漏洞

Dairy Farm Shop Management System is a Dairy Farm Shop Management System by the individual developer Anuj Kumar. A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0, which was discovered to contain an SQL injection attack via sales-report-ds.php...

The vulnerability of the Mozilla Firefox browser, related to a lack of mechanism for verifying data sources, allows attackers to perform spear-phishing attacks.

The vulnerability of the Mozilla Firefox browser is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability allows an attacker to perform spear-phishing attacks remotely...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe...

CVE-2022-2639

creationtimestamp| type| source ---|---|--- 2022-09-02 00:38:43+00:00| seen| https://t.me/cibsecurity/49214 2022-09-06 08:37:12+00:00| published-proof-of-concept| https://t.me/proxybar/950 2022-09-11 10:35:15+00:00| published-proof-of-concept|...

CVE-2022-37129

creationtimestamp| type| source ---|---|--- 2022-09-01 02:37:18+00:00| seen| https://t.me/cibsecurity/49155 2025-10-14 10:31:54+00:00| seen| MISP/a41d8549-5384-5e1a-8c33-bf88e35b5a0a...

Remote Code Execution

flysystem is vulnerable to remote code execution. Lack of proper parameter validation in JMSMessageConsumer allows an attacker to upload and execute malicious code on the system under attack, when a configuration uses a JMS Source with a JNDI LDAP data source URI...

Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

GHSA-H9MH-MGPV-GQMV Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Remote code execution

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Apache Flume 输入验证错误漏洞

Apache Flume is a distributed, reliable and available service from the Apache Foundation, USA. Used to efficiently collect, aggregate, and move large amounts of log data, versions of Apache Flume prior to 1.4.0 through 1.10.0 contain a security vulnerability that stems from vulnerability to remot...

CVE-2022-34916: Improper Input Validation

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

CVE-2022-31665

creationtimestamp| type| source ---|---|--- 2022-08-05 20:20:57+00:00| seen| https://t.me/cibsecurity/47633 2022-12-08 14:11:31+00:00| seen| MISP/d3a33563-6aa9-4388-8f6a-8f738a3a01c1 2026-07-26 02:02:43+00:00| seen| https://t.me/EchelonEyes/512 2026-07-27 00:01:20+00:00| seen|...

GSD-2022-1004470 perf arm-spe: Don't set data source if it's not a memory operation

perf arm-spe: Don't set data source if it's not a memory operation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.51 by commit...

PT-2022-32732

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.15.50 Description The issue concerns a problem where the data source is set even when it's not a memory operation, potentially leading to security vulnerabilities. The actual impact and attack plausibilit...