Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Client Tools 12 package mgr-virtualization, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVE-2021-3711 — CVSS 9.8 (critical): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application…
CVE-2021-41244 — CVSS 9.1 (critical): Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature…
CVE-2020-13379 — CVSS 8.2 (high): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated…
CVE-2021-36222 — CVSS 7.5 (high): ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2…
CVE-2021-28148 — CVSS 7.5 (high): One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is…
CVE-2022-21698 — CVSS 7.5 (high): client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling…
CVE-2019-15043 — CVSS 7.5 (high): In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service…
CVE-2021-27962 — CVSS 7.1 (high): Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a…
CVE-2021-41174 — CVSS 6.9 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to…
CVE-2021-29622 — CVSS 6.5 (medium): Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To…
CVE-2022-21702 — CVSS 6.5 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the…
CVE-2021-28146 — CVSS 6.5 (medium): The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an…
CVE-2021-28147 — CVSS 6.5 (medium): The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control…
CVE-2022-21703 — CVSS 6.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery…
CVE-2019-10215 — CVSS 6.1 (medium): Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could…
CVE-2022-21713 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do…
CVE-2021-43813 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory…
CVE-2021-43815 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal…
CVE-2022-21673 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity…
CVE-2019-10136 — CVSS 4.3 (medium): It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but…