FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-18 11:12:36 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
e2a8e2bd-b808-11ed-b695-6c3be5272acd	Grafana -- Stored XSS in geomap panel plugin via attribution Grafana Labs reports: During an internal audit of Grafana on January 25, a member of the security team found a stored XSS vulnerability affecting the core geomap plugin. The stored XSS vulnerability was possible because map attributions werenÃ¢ÂÂt properly sanitized, allowing arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. The CVSS score for this vulnerability is 7.3 High (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). Discovery 2023-01-25 Entry 2023-03-01 grafana < 8.5.21 ge 9.0.0 lt 9.2.13 ge 9.3.0 lt 9.3.8 grafana8 < 8.5.21 grafana9 ge 9.0.0 lt 9.2.13 ge 9.3.0 lt 9.3.8 CVE-2023-0507 https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/
e7841611-b808-11ed-b695-6c3be5272acd	Grafana -- Stored XSS in TraceView panel Grafana Labs reports: During an internal audit of Grafana on January 30, a member of the engineering team found a stored XSS vulnerability affecting the `TraceView` panel. The stored XSS vulnerability was possible because the value of a spanÃ¢ÂÂs attributes/resources were not properly sanitized, and this will be rendered when the spanÃ¢ÂÂs attributes/resources are expanded. The CVSS score for this vulnerability is 7.3 High (CVSS:7.3/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). Discovery 2023-01-30 Entry 2023-03-01 grafana < 8.5.21 ge 9.0.0 lt 9.2.13 ge 9.3.0 lt 9.3.8 grafana8 < 8.5.21 grafana9 ge 9.0.0 lt 9.2.13 ge 9.3.0 lt 9.3.8 CVE-2023-0594 https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/
0b85b1cd-e468-11ed-834b-6c3be5272acd	Grafana -- Critical vulnerability in golang Grafana Labs reports: An issue in how go handles backticks (`) with Javascript can lead to an injection of arbitrary code into go templates. While Grafana Labs software contains potentially vulnerable versions of go, we have not identified any exploitable use cases at this time. The CVSS score for this vulnerability is 0.0 (adjusted), 9.8 (base). Discovery 2023-04-19 Entry 2023-04-26 grafana < 8.5.24 ge 9.0.0 lt 9.2.17 ge 9.3.0 lt 9.3.13 ge 9.4.0 lt 9.4.9 grafana8 < 8.5.24 grafana9 < 9.2.17 ge 9.3.0 lt 9.3.13 ge 9.4.0 lt 9.4.9 CVE-2023-24538 https://grafana.com/blog/2023/04/26/precautionary-patches-for-grafana-released-following-critical-go-vulnerability-cve-2023-24538/
955eb3cc-ce0b-11ed-825f-6c3be5272acd	Grafana -- Stored XSS in Graphite FunctionDescription tooltip Grafana Labs reports: When a user adds a Graphite data source, they can then use the data source in a dashboard. This capability contains a feature to use Functions. Once a function is selected, a small tooltip appears when hovering over the name of the function. This tooltip allows you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM. Since it is not uncommon to connect to public data sources, an attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker-controlled XSS payload will be executed. The severity of this vulnerability is of CVSSv3.1 5.7 Medium (CVSS: AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N (5.7)). Discovery 2023-03-14 Entry 2023-03-29 grafana < 8.5.22 ge 9.0.0 lt 9.2.15 ge 9.3.0 lt 9.3.11 ge 9.4.0 lt 9.4.7 grafana8 < 8.5.22 grafana9 < 9.2.15 ge 9.3.0 lt 9.3.11 ge 9.4.0 lt 9.4.7 CVE-2023-1410 https://grafana.com/security/security-advisories/cve-2023-1410/