grafana vulnerabilities (TuxCare)
45 vulnerabilities.
grafanaTuxCareSession takeover via Auth Proxy cache key collision7.1 HighgrafanaTuxCareLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 HighgrafanaTuxCareAvoid quadratic complexity in resolvePath in net/url5.9 MediumgrafanaTuxCareAdd recursion depth guard during decode in encoding/xml7.5 HighgrafanaTuxCareFix Javascript regexp context tracking in html/template6.1 MediumgrafanaTuxCareApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http7.5 HighgrafanaTuxCareEnforce maximum recursion depth in encoding/asn17.5 HighgrafanaTuxCareDenial of service via unbounded request body size7.5 HighgrafanaTuxCarePre-authentication denial of service in the public dashboard query endpoint7.5 HighgrafanaTuxCarePath traversal in the Tempo and Loki data source plugins5.4 MediumgrafanaTuxCareGrafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro6.5 MediumgrafanaTuxCareGrafana plugin resources can lead to unbounded memory allocation6.5 MediumgrafanaTuxCareAuth Proxy IPv6 whitelist bypass7.4 HighgrafanaTuxCareBAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5 MediumgrafanaTuxCareDashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin7.1 HighgrafanaTuxCareGrafana Live push endpoint allows unbounded memory allocation leading to OOM6.5 MediumgrafanaTuxCareViewer-triggered race condition in Grafana Live leads to complete server crash6.5 MediumgrafanaTuxCareQuadratic string concatenation in consumePhrase in net/mail7.5 HighgrafanaTuxCareQuadratic string concatentation in consumeComment in net/mail7.5 HighgrafanaTuxCareGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record3.3 LowgrafanaTuxCareUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 HighgrafanaTuxCareInefficient policy validation in crypto/x5097.5 HighgrafanaTuxCareQuery resampling can cause unbounded memory allocations6.5 MediumgrafanaTuxCareGrafana Testdata datasource can issue unbounded memory allocations6.5 MediumgrafanaTuxCarePublic dashboards discloses all direct mode datasources6.5 MediumgrafanaTuxCareIncorrect parsing of IPv6 host literals in net/url7.5 HighgrafanaTuxCarePublic Dashboards time range restriction on annotations can be bypassed5.3 MediumgrafanaTuxCareDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 HighgrafanaTuxCareUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out7.5 HighgrafanaTuxCareUnexpected session resumption in crypto/tls10.0 CriticalgrafanaTuxCareExcessive CPU consumption when building archive index in archive/zip6.5 MediumgrafanaTuxCareMemory exhaustion in query parameter parsing in net/url7.5 HighgrafanaTuxCareExcessive resource consumption when printing error string for host certificate validation in crypto/x5097.5 HighgrafanaTuxCareUnbounded allocation when parsing GNU sparse map in archive/tar4.3 MediumgrafanaTuxCarejwt-go allows excessive memory allocation during header parsing7.5 HighgrafanaTuxCareGo JOSE's Parsing Vulnerable to Denial of Service6.6 MediumgrafanaTuxCareGrafana org admin can delete pending invites in different org2.2 LowgrafanaTuxCareUnexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip9.8 CriticalgrafanaTuxCareGrafana vulnerable to Cross-site Scripting7.3 HighgrafanaTuxCareGrafana stored XSS in FileUploader component7.3 HighgrafanaTuxCareGrafana vulnerable to spoofing originalUrl of snapshots6.7 MediumgrafanaTuxCareGrafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password6.7 MediumgrafanaTuxCareGrafana contains Improper Input Validation6.4 MediumgrafanaTuxCareGrafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins4.9 MediumgrafanaTuxCareInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical