Количество 11
Количество 11
BDU:2024-08254
Уязвимость функции Expressions платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код
ROS-20241211-09
Множественные уязвимости grafana
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
CVE-2024-9264
The SQL Expressions experimental feature of Grafana allows for the eva ...
GHSA-q99m-qcv4-fpm7
Grafana Command Injection And Local File Inclusion Via Sql Expressions
SUSE-SU-2025:01991-1
Security update for grafana
SUSE-SU-2025:01989-1
Security update for Multi-Linux Manager Client Tools
SUSE-SU-2025:01987-1
Security update for Multi-Linux Manager Client Tools
SUSE-SU-2024:3911-1
Security update for govulncheck-vulndb
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2024-08254 Уязвимость функции Expressions платформы для мониторинга и наблюдения Grafana, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.9 | 92% Критический | около 1 года назад |
 | ROS-20241211-09 Множественные уязвимости grafana | CVSS3: 9.9 | 11 месяцев назад | |
 | CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | CVSS3: 9.9 | 92% Критический | около 1 года назад |
 | CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | CVSS3: 9.9 | 92% Критический | около 1 года назад |
 | CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. | CVSS3: 9.9 | 92% Критический | около 1 года назад |
| CVE-2024-9264 The SQL Expressions experimental feature of Grafana allows for the eva ... | CVSS3: 9.9 | 92% Критический | около 1 года назад |
| GHSA-q99m-qcv4-fpm7 Grafana Command Injection And Local File Inclusion Via Sql Expressions | CVSS3: 9.9 | 92% Критический | около 1 года назад |
 | SUSE-SU-2025:01991-1 Security update for grafana | 5 месяцев назад | ||
| SUSE-SU-2025:01989-1 Security update for Multi-Linux Manager Client Tools | 5 месяцев назад | ||
| SUSE-SU-2025:01987-1 Security update for Multi-Linux Manager Client Tools | 5 месяцев назад | ||
| SUSE-SU-2024:3911-1 Security update for govulncheck-vulndb | 12 месяцев назад |
Уязвимостей на страницу