Количество 8
Количество 8
GHSA-9g84-39mm-q4p3
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
CVE-2026-9029
A user with Editor permissions can place a malicious script in the att ...
ROS-20260714-80-0068
Уязвимость grafana
BDU:2026-10839
Уязвимость панели Geomap платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код
ROS-20260714-73-0063
Уязвимость grafana
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-9g84-39mm-q4p3 The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting). | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting). | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting). | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
| CVE-2026-9029 A user with Editor permissions can place a malicious script in the att ... | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | ROS-20260714-80-0068 Уязвимость grafana | CVSS3: 5.4 | 0% Низкий | 2 месяца назад |
 | BDU:2026-10839 Уязвимость панели Geomap платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код | CVSS3: 5.4 | 0% Низкий | 3 месяца назад |
| ROS-20260714-73-0063 Уязвимость grafana | CVSS3: 5.4 | 0% Низкий | 2 месяца назад |
Уязвимостей на страницу