CVE-2024-4200

Progress Telerik Reporting (prior to 2024 Q2; 18.1.24.2.514) is affected by an insecure deserialization vulnerability that can lead to code execution by a local attacker. The issue affects the remote Windows host running the product, with the root cause being insecure deserialization in the appli...

CVE-2024-4202 Progress Telerik Reporting Local Instantiation Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.514, a code execution attack is possible through an insecure instantiation vulnerability...

CVE-2024-4202

CVE-2024-4202 affects Progress Telerik Reporting versions prior to 2024 Q2 (18.1.24.514). The vulnerability is described as an insecure instantiation vulnerability that enables code execution. The CVE details in the provided documents indicate high impact (confidentiality, integrity, and availabi...

CVE-2024-4202 Progress Telerik Reporting Local Instantiation Vulnerability

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.514, a code execution attack is possible through an insecure instantiation vulnerability...

CVE-2024-4202: Improper Control of Generation of Code

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.514, a code execution attack is possible through an insecure instantiation vulnerability...

PT-2024-29691

Name of the Vulnerable Software and Affected Versions In Progress Telerik Reporting versions prior to 2024 Q2 18.1.24.514 Description A code execution attack is possible through an insecure instantiation vulnerability, allowing for potential exploitation. Recommendations For versions prior to 202...

CVE-2024-4200: Deserialization of Untrusted Data

In Progress® Telerik® Reporting versions prior to 2024 Q2 18.1.24.2.514, a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability...

PT-2024-29683 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q2 18.1.24.2.514 Description: A code execution attack is possible by a local threat actor through an insecure deserialization vulnerability, allowing for potential exploitation...

Grafana folders admin only permission privilege escalation

Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-36062 that affects Grafana instances which are using Grafana role-based access control RBAC. Release 9.1.6, latest patch, also containing security fix: - Download Grafana...

GHSA-X744-MM8V-VPGR Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39201 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues. Release 9.2, latest release, also...

Grafana Email addresses and usernames can not be trusted

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate severity security fixes for CVE-2022-39306. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - Download...

GHSA-3P62-42X7-GXG5 Grafana User enumeration via forget password

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - Download Grafana 9.2...

Grafana User enumeration via forget password

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - Download Grafana 9.2...

GHSA-VQC4-MPJ8-JXCH Grafana Race condition allowing privilege escalation

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes critical security fixes for CVE-2022-39328. Release 9.2.4, latest patch, also containing security fix: - Download Grafana 9.2.4 Appropriate patches have been applied to Grafana Cloud and as always, we...

GHSA-FF5C-938W-8C9Q Grafana Escalation from admin to server admin when auth proxy is used

Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-35957 that affects Grafana instances which are using Grafana Auth Proxy. Release 9.1.6, latest patch, also containing security fix: - Download Grafana 9.1.6 - Release not...

Grafana Escalation from admin to server admin when auth proxy is used

Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-35957 that affects Grafana instances which are using Grafana Auth Proxy. Release 9.1.6, latest patch, also containing security fix: - Download Grafana 9.1.6 - Release not...

GHSA-JV32-5578-PXJC Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-31130 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues. Release 9.2, latest release, also...

Grafana API IDOR

Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5....

Grafana Fine-grained access control vulnerability

Impact On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, ad...

chiropraxis-cottbus.de Cross Site Scripting vulnerability OBB-3927000

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...