231 matches found
PT-2024-35174 · Amazon +1 · Cloudwatch +2
Name of the Vulnerable Software and Affected Versions: data.all affected versions not specified Description: A data.all admin team member with access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs via CloudWatch log...
Malicious code in client-cloudwatch-logs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9546 Malicious code in client-cloudwatch-logs (npm)
--- -= Per source details. Do not edit below this line.=-...
GHSA-G8M5-722R-8WHQ vulnerabilities
Vulnerabilities for packages: cloudwatch-exporter, confluent-kafka, prometheus-jmx-exporter, druid, solr, spark, apache-tika, confluent-kafka-jre-bcfips, zookeeper-fips, strimzi-kafka-operator, cassandra-reaper, kafka, spark-fips, celeborn, apache-nifi, zookeeper...
GHSA-G8M5-722R-8WHQ vulnerabilities
Vulnerabilities for packages: druid, strimzi-kafka-operator, zookeeper, cassandra-reaper, cloudwatch-exporter, confluent-kafka, apache-nifi, solr...
CVE-2024-8184 vulnerabilities
Vulnerabilities for packages: druid, strimzi-kafka-operator, zookeeper, cassandra-reaper, cloudwatch-exporter, confluent-kafka, apache-nifi, solr...
CVE-2024-8184 vulnerabilities
Vulnerabilities for packages: cloudwatch-exporter, confluent-kafka, prometheus-jmx-exporter, druid, solr, spark, apache-tika, confluent-kafka-jre-bcfips, zookeeper-fips, strimzi-kafka-operator, cassandra-reaper, kafka, spark-fips, celeborn, apache-nifi, zookeeper...
Token Leakage
sagemakertrainin is vulnerable to Token Leakage. The vulnerability is due to the logging of CodeArtifact authorization tokens in log files, which, when pushed to CloudWatch Log streams, It can allow unauthorized access to CodeArtifact resources...
AWS SageMaker Training Toolkit logs CodeArtifact Authorization token
Description For SageMaker Training Toolkit1 versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact temporary token with an expiration of 12 hours were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their...
GHSA-635V-PC42-FR74 AWS SageMaker Training Toolkit logs CodeArtifact Authorization token
Description For SageMaker Training Toolkit1 versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact temporary token with an expiration of 12 hours were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their...
PT-2024-40110 · Amazon · Cloudwatch +2
Name of the Vulnerable Software and Affected Versions: SageMaker Training Toolkit versions 4.7.0 through 4.7.4 Description: The issue concerns the logging of authorization tokens for CodeArtifact in log files when the CodeArtifact capability is enabled. These tokens have an expiration of 12 hours...
Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2630)
The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300044.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2630 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
OpenTelemetry Collector < 0.108.0 Authentication Bypass
The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...
Important: amazon-cloudwatch-agent
Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability
Summary OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key. OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream. Firehose sets the header X-Amz-Firehose-Access-Key with an...
CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability
The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...
GO-2022-1160 Amazon CloudWatch Agent for Windows has Privilege Escalation Vector in github.com/aws/amazon-cloudwatch-agent
Amazon CloudWatch Agent for Windows has Privilege Escalation Vector in github.com/aws/amazon-cloudwatch-agent...
Malicious code in fluent_plugin-cloudwatch-logs-foxtrot9 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...