Known vulnerabilities in Grafana - page 6

Software: Grafana
Software CPE: cpe:2.3:a:grafana_labs:grafana:*:*:*:*:*:*:*:*
Total vulnerabilities: 118
Public exploits: 11
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Grafana Grafana is affected by 118 known vulnerabilities: 7 high, 43 medium, 68 low Critical High Medium Low

Vulnerabilities (118)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU51582 - Improper Control of Interaction Frequency
CVE-2021-28148
CWE-799 Medium
No
No
6.7.6, 7.3.10, 7.4.5 19.03.2021 SB2021031903
SB2021081235
SB2021081237
and 3 more
#VU41684 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11110
CWE-79 Low
Available
No
6.7.2 10.08.2020 SB2020072753
#VU28581 - Server-Side Request Forgery (SSRF)
CVE-2020-13379
CWE-918 Medium
Available
No
6.7.4, 7.0.2 04.06.2020 SB2020060421
SB2020062606
SB2020062610
and 10 more
#VU34376 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-18623
CWE-79 Low
No
No
- 02.06.2020 SB2020060231
#VU34377 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-18624
CWE-79 Low
No
No
- 02.06.2020 SB2020060231
#VU34378 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-18625
CWE-79 Low
No
No
- 02.06.2020 SB2020060231
#VU28224 - Cleartext Storage of Sensitive Information
CVE-2020-12458
CWE-312 Low
No
No
7.0.0 25.05.2020 SB2020052517
#VU28223 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-13430
CWE-79 Low
No
No
7.0.0 25.05.2020 SB2020052517
SB2020070752
#VU27396 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-12245
CWE-79 Medium
No
No
6.7.3 28.04.2020 SB2020042825
SB2020063016
SB2020072802
and 3 more
#VU30299 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-12052
CWE-79 Low
No
No
6.7.3 27.04.2020 SB2020042723
SB2020070752
#VU26545 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
6.7.2 02.04.2020 SB2020040211
#VU21237 - Unprotected Storage of Credentials
CVE-2019-15635
CWE-256 Low
No
No
6.3.0 20.09.2019 SB2019092013
SB2019092407
SB2019092510
and 4 more
#VU21236 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-13068
CWE-79 Low
Available
No
6.2.5 20.09.2019 SB2019063002
#VU20497 - Improper Access Control
CVE-2019-15043
CWE-284 Medium
No
No
5.4.5, 6.3.4 02.09.2019 SB2019090201
SB2019090203
SB2020042903
and 7 more
#VU16814 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-1000816
CWE-79 Low
No
No
5.3.2 04.01.2019 SB2018101407
#VU15923 - Exposure of sensitive information to an unauthorized actor
CVE-2018-19039
CWE-200 Low
No
No
4.6.5, 5.3.3 15.11.2018 SB2018111603
SB2018111604
SB2019041109
and 2 more
#VU14575 - Improper Authentication
CVE-2018-15727
CWE-287 High
Available
No
4.6.4, 5.2.3 30.08.2018 SB2018083101
SB2018121805
SB2019010406
#VU14319 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-12099
CWE-79 Low
No
No
5.2.0 13.08.2018 SB2018050850


Showing elements 101 - 120 out of 118