Credentials Exposure

github.com/grafana/grafana-plugin-sdk-go is vulnerable to Credentials Exposure. The vulnerability is due to the inclusion of the full repository URI, including credentials, in the metadata bundled within the compiled binaries during the build process, which allows an attacker to gain unauthorized...

CVE-2024-8986

A flaw was found in grafana-plugin-sdk-go package. The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository UR...

CVE-2024-8986

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

CVE-2024-8986 Information Leakage in grafana-plugin-sdk-go

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

CVE-2024-8986

CVE-2024-8986 is tied to Grafana’s grafana-plugin-sdk-go which embeds build metadata in binaries, including the repository URL obtained via git remote get-url origin. If credentials are present in that URL, the final binary may contain the full URI with credentials, creating a risk of credential ...

CVE-2024-8986 Information Leakage in grafana-plugin-sdk-go

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

CVE-2024-8986: Insufficiently Protected Credentials

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

PT-2024-6336 · Grafana · Grafana Plugin Sdk

Name of the Vulnerable Software and Affected Versions: Grafana Plugin SDK versions prior to 0.250.0 Description: The issue is related to the Grafana Plugin SDK bundling build metadata into the binaries it compiles, which includes the repository URI for the plugin being built. If credentials are...

Information Disclosure in Plugin SDK in Grafana

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin . If credentials are included in the repository URI for instance, to allow for fetching of private...

alfrodull (0.1.0), getccwarc (>=0.0.1.dev23, <=0.0.1.dev34) +3 more potentially affected by CVE-2024-5569 via zipp (0.5.1)

zipp PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - alfrodull 0.1.0 - getccwarc =0.0.1.dev23, =1.2.2, =0.0.2, =0.0.3 Source cves: CVE-2024-5569 Source advisory: OSV:GHSA-JFMJ-5V4G-7637...

aiosoma (1.1.18), candlestick-patterns (>=1.0.1, <=1.2.0) +3 more potentially affected by CVE-2024-21503 via black (23.12.0)

black PYPI version 23.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.18 - candlestick-patterns =1.0.1, =0.1.9, =2.97.0, =0.39.0, =0.39.6 Source cves: CVE-2024-21503 Source advisory: OSV:GHSA-FJ7X-Q9J7-G6Q6...

aiosoma (>=1.1.9, <=1.1.11), amsdal-models (>=0.0.1, <=0.0.20) +12 more potentially affected by CVE-2024-21503 via black (23.9.1)

black PYPI version 23.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma =1.1.9, =0.0.1, =1.0.0, =0.1.4, =0.4.9a2, =0.0.5, =2.84.0, =0.1.0, =0.1.0, =0.1.0, =2023.33.0, =2024.31.0 Source cves: CVE-2024-21503 Source...

antimatter (0.1.3), arcaflow-plugin-sdk (0.13.0) +3 more potentially affected by CVE-2024-26134 via cbor2 (>=5.5.1, <=5.6.1)

cbor2 PYPI version =5.5.1, =0.1.0, =1.20.0, =0.0.2, =0.0.6 Source cves: CVE-2024-26134 Source advisory: OSV:GHSA-375G-39JQ-VQ7M...

antimatter (0.1.3), arcaflow-plugin-sdk (0.13.0) +3 more potentially affected by CVE-2024-26134 via cbor2 (>=5.5.1, <=5.6.1)

cbor2 PYPI version =5.5.1, =0.1.0, =1.20.0, =0.0.2, =0.0.6 Source cves: CVE-2024-26134 Source advisory: GHSA-375G-39JQ-VQ7M...

antimatter (0.1.3), arcaflow-plugin-sdk (0.13.0) +3 more potentially affected by CVE-2024-26134 via cbor2 (>=5.5.1, <=5.6.1)

cbor2 PYPI version =5.5.1, =0.1.0, =1.20.0, =0.0.2, =0.0.6 Source cves: CVE-2024-26134 Source advisory: OSV:PYSEC-2024-155...

antimatter (0.1.3), arcaflow-plugin-sdk (0.13.0) +3 more potentially affected by CVE-2024-26134 via cbor2 (>=5.5.1, <=5.6.1)

cbor2 PYPI version =5.5.1, =0.1.0, =1.20.0, =0.0.2, =0.0.6 Source cves: CVE-2024-26134 Source advisory: MEND:CVE-2024-26134...

CVE-2022-32576

Uncontrolled search path in the IntelR UniteR Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

Privilege escalation

Uncontrolled search path in the IntelR UniteR Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-32576

CVE-2022-32576 is an issue in the Intel® Unite® Plugin SDK prior to 4.2. The root cause is an uncontrolled search path, which may allow an authenticated user to escalate privileges via local access. Affected product: Intel® Unite® Plugin SDK before 4.2. As remediation, Intel recommends updating t...

CVE-2022-32576: Uncontrolled Search Path Element

Uncontrolled search path in the IntelR UniteR Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege via local access...