golang-github-prometheus-node_exporter (SUSE:HPE Helion OpenStack 8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:HPE Helion OpenStack 8 package golang-github-prometheus-node_exporter, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (17)

• CVE-2021-3711 — CVSS 9.8 (critical): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application…
• CVE-2021-39226 — CVSS 9.8 (critical) — actively exploited: Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the…
• CVE-2021-41244 — CVSS 9.1 (critical): Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature…
• CVE-2020-13379 — CVSS 8.2 (high): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated…
• CVE-2021-36222 — CVSS 7.5 (high): ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2…
• CVE-2022-21698 — CVSS 7.5 (high): client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling…
• CVE-2019-15043 — CVSS 7.5 (high): In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service…
• CVE-2021-43798 — CVSS 7.5 (high) — actively exploited: Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched…
• CVE-2021-41174 — CVSS 6.9 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to…
• CVE-2022-21702 — CVSS 6.5 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the…
• CVE-2022-21703 — CVSS 6.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery…
• CVE-2019-10215 — CVSS 6.1 (medium): Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could…
• CVE-2020-12245 — CVSS 6.1 (medium): Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
• CVE-2022-21673 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity…
• CVE-2021-43815 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal…
• CVE-2021-43813 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory…
• CVE-2022-21713 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do…