Поиск уязвимостей
Количество 12
Количество 12
CVE-2025-12141
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
CVE-2025-12141
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
CVE-2025-12141
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
CVE-2025-12141
In Grafana's alerting system, users with edit permissions for a contac ...
GHSA-pcxf-fmpx-32ph
In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.
BDU:2026-05567
Уязвимость системы оповещений платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
ROS-20260515-80-0021
Уязвимость grafana
ROS-20260515-73-0012
Уязвимость grafana
openSUSE-SU-2026:21351-1
Security update for grafana
ALT-PU-2026-2386
ALT-PU-2026-2386: package `grafana` update to version 12.3.2-alt1
SUSE-SU-2026:3718-1
Security update for grafana
ALT-PU-2026-15352
ALT-PU-2026-15352: package `grafana` update to version 12.3.6-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations. | CVSS3: 6.5 | 0% Низкий | 7 месяцев назад |
 | CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations. | CVSS3: 5 | 0% Низкий | 7 месяцев назад |
 | CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations. | CVSS3: 6.5 | 0% Низкий | 7 месяцев назад |
| CVE-2025-12141 In Grafana's alerting system, users with edit permissions for a contac ... | CVSS3: 6.5 | 0% Низкий | 7 месяцев назад |
| GHSA-pcxf-fmpx-32ph In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role "Contact Point Writer", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations. | CVSS3: 6.5 | 0% Низкий | 7 месяцев назад |
 | BDU:2026-05567 Уязвимость системы оповещений платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 4.3 | 0% Низкий | 7 месяцев назад |
 | ROS-20260515-80-0021 Уязвимость grafana | CVSS3: 4.3 | 0% Низкий | 6 месяцев назад |
| ROS-20260515-73-0012 Уязвимость grafana | CVSS3: 4.3 | 0% Низкий | 6 месяцев назад |
 | openSUSE-SU-2026:21351-1 Security update for grafana | 4 месяца назад | ||
| ALT-PU-2026-2386 ALT-PU-2026-2386: package `grafana` update to version 12.3.2-alt1 | CVSS3: 10 | 9 месяцев назад | |
| SUSE-SU-2026:3718-1 Security update for grafana | 3 месяца назад | ||
| ALT-PU-2026-15352 ALT-PU-2026-15352: package `grafana` update to version 12.3.6-alt1 | CVSS3: 10 | около 2 месяцев назад |
Уязвимостей на страницу