2 matches found
New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder
This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...
New Relic: NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled
@jonbottarini identified an issue where our permissions for Synthetics didn't match the permissions elsewhere in our product. This eventually led to a change in our underlying permissions code to unify our products and prevent issues like this...