com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.alibaba.nacos:nacos-client (0.6.2) +13 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.6.2)

com.alibaba.nacos:nacos-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.alibaba.nacos:nacos-client 0.6.2 -...

com.alibaba.csp:sentinel-datasource-nacos (>=0.1.1, <=0.1.2), com.alibaba.csp:sentinel-demo-nacos-datasource (>=0.1.1, <=0.1.2) +6 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.1.0)

com.alibaba.nacos:nacos-common MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos =0.1.1, =0.1.1, =3.4.7, =3.4.0, =3.7.0, =3.4.0, =3.7.0,...

com.alibaba.csp:sentinel-datasource-nacos (1.4.0), com.alibaba.nacos:nacos-client (0.2.1) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.0 - com.alibaba.nacos:nacos-client 0.2.1 Source cves:...

com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.alibaba.nacos:nacos-client (0.6.2) +13 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.6.2)

com.alibaba.nacos:nacos-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.alibaba.nacos:nacos-client 0.6.2 -...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.alibaba.nacos:nacos-client (0.3.0) +9 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.3.0)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.alibaba.nacos:nacos-client 0.3.0 -...

PT-2021-3167

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.0 through 2.9.10.7 Description The issue is related to the interaction between serialization gadgets and typing, specifically involving the org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource...

UBUNTU-CVE-2020-35491

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource...

PT-2020-6950

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8 Description The issue is related to the interaction between serialization gadgets and typing, which can lead to the exploitation of the vulnerability. This may allow a remote attacker to...

cloud-init security, bug fix, and enhancement update

19.4-11.0.1 - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 Orabug: 30435672 - Update OCI Datasource to support IMDSv2 - limit permissions Orabug: 31352433 - Changes to ignore all enslaved interfaces Orabug: 30092148 - Fix swap file size allocation logic to allocate...

grafana: information disclosure through world-readable /var/lib/grafana/grafana.db

An information-disclosure flaw was found in the way Grafana set permissions for the database directory and file. This flaw allows a local attacker access to potentially sensitive information such as cleartext or encrypted datasource passwords from /var/lib/grafana/grafana.db...

Grafana < 7.1.0-beta1 XSS Vulnerability

Grafana is vulnerable to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2020-24303

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

CVE-2020-24303

CVE-2020-24303 : Grafana before 7.1.0-beta1 is vulnerable to an XSS via a query alias for the Elasticsearch datasource. Root cause per the public description is improper input handling in the query alias pathway, enabling script execution in a victim’s browser. Exploitation status not described i...

CVE-2020-24303: Improper Neutralization of Input During Web Page Generation

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

PT-2020-15676

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.1.0-beta1 Description The issue allows for XSS via a query alias for the ElasticSearch datasource. There is no information provided about the estimated number of potentially affected devices worldwide or details abo...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

CVE-2020-13430

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

CVE-2020-13430: Improper Neutralization of Input During Web Page Generation

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

PT-2020-13536

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.0.0 Description The issue allows tag value XSS via the OpenTSDB datasource. This can be exploited in Grafana, potentially affecting devices that use the OpenTSDB datasource. No information is provided about the...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...