Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1029 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags...

CVE-2024-52314

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-45043

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2019-1003062

Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2851)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300054.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2851 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh-serving, kind, q, nginx-prometheus-exporter, checksec, gke-gcloud-auth-plugin, tw, supercronic, go-licenses, yace, crossplane, tfsec, crossplane-provider-azure, hey, nri-memcached, nri-mongodb, nri-nginx, tflint, nri-postgresql, yunikorn-web,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: kserve-modelmesh-serving, kind, q, nginx-prometheus-exporter, checksec, gke-gcloud-auth-plugin, tw, supercronic, go-licenses, yace, crossplane, tfsec, crossplane-provider-azure, hey, nri-memcached, nri-mongodb, nri-nginx, tflint, nri-postgresql, yunikorn-web,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: doppler-kubernetes-operator, prometheus-redis-exporter, pgtimetable-fips, restic, go-md2man, karma, opentelemetry-collector-contrib-fips, dex, kubernetes-csi-driver-nfs, minio-operator, neuvector-dbgen-fips, nvidia-nsight-compute-13.1, yace,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: doppler-kubernetes-operator, prometheus-redis-exporter, pgtimetable-fips, restic, go-md2man, karma, opentelemetry-collector-contrib-fips, dex, kubernetes-csi-driver-nfs, minio-operator, neuvector-dbgen-fips, nvidia-nsight-compute-13.1, yace,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, tkn, pulumi, nuclei, cosign, splunk-otel-collector, temporal-server, filebrowser, opentofu, terraform-provider-azapi, traefik, skaffold, velero, terraform-provider-azurerm, kargo, harbor-registry, kube-metrics-adapter, loki, flyte,...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: docker, openfga-fips, openfga, step, gitness, actions-runner-controller-fips, kubeflow-katib, vault, grafana-alloy-fips, restic, opencost, traefik, opentelemetry-collector-contrib-fips, amazon-cloudwatch-agent-operator, kaniko, fulcio-fips, ksops, minio-operator,...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2779)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300052.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2779 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause ...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, wildfly, cassandra-reaper, docker-selenium, trino, selenium, keycloak, flyway, cloudwatch-exporter, celeborn, apache-activemq-artemis, tez, druid, wavefront-proxy, kserve-modelmesh, apache-pulsar, apicurio-registry,...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, wildfly, cassandra-reaper, docker-selenium, trino, selenium, keycloak, flyway, cloudwatch-exporter, celeborn, apache-activemq-artemis, tez, druid, wavefront-proxy, kserve-modelmesh, apache-pulsar, apicurio-registry,...

AWS VDP: Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity...

AIOps - Revolutionizing Incident Management with Advanced Automation and LLM Integration

AIOps - Revolutionizing Incident Management with Advanced Automation and LLM Integration By Trellix · November 14, 2024 Contributed by Chalapathy Jampal, Siddhesh Shinde, Alagiri Annadurai, Lakshmi Ram Teja Eluri and Anil Pokhrel Managing infrastructure and applications across a complex IT...

CVE-2024-52314

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...