CVE-2022-38671

creationtimestamp| type| source ---|---|--- 2022-10-14 22:29:22+00:00| seen| https://t.me/cibsecurity/51498...

CVE-2022-39201

A flaw was found in Grafana. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. Grafana could leak the authentication cookie of users to plugins, which could result in an impact to confidentiality, integrity, and availability...

CVE-2022-31130

A flaw was found in Grafana's use of the GitLab data source plugin, leaking the API key to gitlab. This can result in the destination plugin receiving a Grafana user's authentication token, which could be used by an attacker...

CVE-2022-39201

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

UBUNTU-CVE-2022-39201

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-39201

Grafana CVE-2022-39201 affects Grafana before patches in 8.5.14 and 9.1.8. The issue allows a destination plugin to receive a user’s Grafana authentication cookie via data source and plugin proxy endpoints under certain conditions, enabling cookie leakage. Patched in Grafana 8.5.14 and 9.1.8; oth...

CVE-2022-31130 Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

CVE-2022-39201 Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

The vulnerability of the WebDriver driver for the Mozilla Firefox browser allows a hacker to disclose protected information and execute arbitrary code.

The vulnerability of the WebDriver driver for the Mozilla Firefox browser is related to a lack of mechanisms for verifying the data source. Exploiting this vulnerability allows a malicious actor, operating remotely, to circumvent established security restrictions, disclose sensitive information,...

Dairy Farm Shop Management System SQL注入漏洞

Dairy Farm Shop Management System is a Dairy Farm Shop Management System by the individual developer Anuj Kumar. A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0, which was discovered to contain an SQL injection attack via sales-report-ds.php...

The vulnerability of the Mozilla Firefox browser, related to a lack of mechanism for verifying data sources, allows attackers to perform spear-phishing attacks.

The vulnerability of the Mozilla Firefox browser is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability allows an attacker to perform spear-phishing attacks remotely...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe...

CVE-2022-2639

creationtimestamp| type| source ---|---|--- 2022-09-02 00:38:43+00:00| seen| https://t.me/cibsecurity/49214 2022-09-06 08:37:12+00:00| published-proof-of-concept| https://t.me/proxybar/950 2022-09-11 10:35:15+00:00| published-proof-of-concept|...

CVE-2022-37129

creationtimestamp| type| source ---|---|--- 2022-09-01 02:37:18+00:00| seen| https://t.me/cibsecurity/49155 2025-10-14 10:31:54+00:00| seen| MISP/a41d8549-5384-5e1a-8c33-bf88e35b5a0a...

Remote Code Execution

flysystem is vulnerable to remote code execution. Lack of proper parameter validation in JMSMessageConsumer allows an attacker to upload and execute malicious code on the system under attack, when a configuration uses a JMS Source with a JNDI LDAP data source URI...

GHSA-H9MH-MGPV-GQMV Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...