Lucene search
+L

662 matches found

OSV
OSV
•added 2025/06/02 11:15 a.m.•16 views

UBUNTU-CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

5CVSS6.8AI score0.00456EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2025/06/02 10:34 a.m.•7 views

CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

5CVSS6.6AI score0.00456EPSS
SaveExploits0References1
CVE
CVE
•added 2025/06/02 10:34 a.m.•374 views

CVE-2025-3454

Grafana’s CVE-2025-3454 affects the datasource proxy API, where an extra slash in the URL path bypasses authorization checks, potentially allowing read access to GET endpoints for Alertmanager and Prometheus datasources. The issue targets route-specific permission implementations and is noted in ...

5CVSS6.6AI score0.00456EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
•added 2025/06/02 10:34 a.m.•104 views

CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

5CVSS5.4AI score0.00456EPSS
SaveExploits0
Grafana
Grafana
•added 2025/06/02 12:00 a.m.•28 views

Authorization Bypass in Datasource Proxy

This vulnerability in Grafana’s datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

5CVSS6.6AI score0.00456EPSS
SaveExploits0
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/06/02 12:00 a.m.•1 views

CVE-2025-3454: Improper Authorization

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

5CVSS5.9AI score0.00456EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2025/05/23 2:39 a.m.•12 views

CVE-2023-5123

The JSON datasource plugin https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint including a specific sub-path configured by an administrator. Due to inadequate...

8CVSS7.1AI score0.0077EPSS
SaveExploits0References1
OSV
OSV
•added 2025/05/05 8:15 p.m.•13 views

CVE-2025-45618

Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload...

6.5CVSS5.8AI score0.00349EPSS
SaveExploits1References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/05/05 12:00 a.m.•0 views

CVE-2025-45618: Improper Access Control

Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload...

6.5CVSS5.7AI score0.00349EPSS
SaveExploits1References1
SUSE CVE
SUSE CVE
•added 2025/04/24 11:33 a.m.•10 views

SUSE CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

4.3CVSS6.7AI score0.00456EPSS
SaveExploits0References8
Snyk
Snyk
•added 2025/03/27 3:31 p.m.•7 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the /kylin/api/xxx/diag endpoint. An attacker can forge requests to internal services by invoking this specific API endpoint on another host. Notes: 1 This is only exploitable if the attacker has...

6.5CVSS7AI score0.00631EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
•added 2025/03/27 2:33 p.m.•19 views

CVE-2024-55604

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a...

4.8CVSS6.3AI score0.00247EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/03/26 12:00 a.m.•2 views

CVE-2024-55964: Improper Control of Generation of Code

An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that...

9.8CVSS8.4AI score0.06754EPSS
SaveExploits1References1
OSV
OSV
•added 2025/03/25 2:15 p.m.•13 views

CVE-2024-55604 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a...

4.8CVSS5.9AI score0.00436EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2025/03/25 2:15 p.m.•30 views

CVE-2024-55604 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a...

4.8CVSS0.00247EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2025/03/25 12:00 a.m.•60 views

PT-2025-12805 · Appsmith · Appsmith

Name of the Vulnerable Software and Affected Versions: Appsmith versions prior to 1.51 Description: The issue concerns an information disclosure where users invited as "App Viewer" can access development information of a workspace, specifically getting a list of datasources. This does not expose...

4.8CVSS5.9AI score0.00247EPSS
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
•added 2025/03/01 2:19 a.m.•10 views

Malicious code in esm-appdynamics-grafana-react-datasource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18f395665c4d165d336c17cf90f183b9da91013f0d72574f6b2875830ed057d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.8AI score
SaveExploits0References1
CNVD
CNVD
•added 2025/02/19 12:00 a.m.•42 views

Apache Linkis Input Validation Error Vulnerability

Apache Linkis is a middleware product of the U.S. Apache Apache Foundation, which can establish an effective connection between upper-tier applications and the underlying data engine. An input validation error vulnerability exists in Apache Linkis versions prior to 1.7.0, which stems from the lac...

5.9CVSS6.6AI score0.00324EPSS
SaveExploits0References1
AstraLinux
AstraLinux
•added 2025/02/06 4:28 p.m.•0 views

Astra Linux - уязвимость в jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource aka Anteros-DBCP...

8.1CVSS7AI score0.0758EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
•added 2025/02/05 3:17 a.m.•18 views

CVE-2024-51408

AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials...

8.5CVSS5.9AI score0.00483EPSS
SaveExploits1References1
Rows per page
Query Builder