CVE-2021-42080

An attacker is able to launch a Reflected XSS attack using a crafted URL.

CVE-2021-4406

An administrator is able to execute commands as root via the alerts management dialog

CVE-2021-42082

Local users are able to execute scripts under root privileges.

CVE-2021-42081

An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.

CVE-2021-42079

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests.

CVE-2021-42083

An authenticated attacker is able to create alerts that trigger a stored XSS attack.