Design/Logic Flaw

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-31176

CVE-2022-31176 concerns Grafana Image Renderer, a Grafana backend plugin that renders panels to PNGs via a headless browser. An internal security review identified an unauthorized file disclosure vulnerability: a malicious user could retrieve unauthorized files under certain network conditions or...

PT-2022-20588 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 3.6.1 Description: An unauthorized file disclosure issue was identified in Grafana, allowing a malicious user to retrieve unauthorized files under certain network conditions or via a fake datasource, particularly if...

CVE-2022-31176 Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

GHSA-RV3R-VQJJ-8C76 Cross-site scripting from content entered in the tags and multiselect fields

Introduction Cross-site scripting XSS is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such...

Cross-site scripting from content entered in the tags and multiselect fields

Introduction Cross-site scripting XSS is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such...

PT-2022-28279 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.1 Kirby versions prior to 3.6.6.1 Kirby versions prior to 3.7.4 Description: Cross-site scripting XSS allows the execution of JavaScript code inside the Panel session of the same or other users. This vulnerabilit...

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-36037

kirby is a content management system CMS that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting XSS is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel,...

Cross site scripting

kirby is a content management system CMS that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting XSS is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel,...

CVE-2022-36037 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

kirby is a content management system CMS that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting XSS is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel,...

CVE-2022-36037 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

kirby is a content management system CMS that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting XSS is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel,...

CVE-2022-36037 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

kirby is a content management system CMS that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting XSS is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel,...

[SECURITY] Fedora 36 Update: webkit2gtk3-2.36.7-1.fc36

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

Ubuntu: Security Advisory (USN-2438-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2021-3481

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics SVG file this flaw may lead to an unauthorized memory access. The highest threat...

nbconvert 跨站脚本漏洞

nbconvert is Project Jupyter open source a format conversion library . Jupyter .ipynb notebook document files into another static format , including HTML, LaTeX, PDF, Markdown and so on. A cross-site scripting vulnerability exists in versions prior to nbconvert 6.3. The vulnerability stems from t...

The vulnerability of the web page rendering module in WebKit operating systems for macOS, iOS, and iPadOS allows attackers to execute arbitrary code.

The vulnerability of the web page rendering module in WebKit operating systems for macOS, iOS, and iPadOS is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

openSUSE: Security Advisory for webkit2gtk3 (SUSE-SU-2022:2820-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...