Jaeger UI 跨站脚本漏洞

Jaeger UI is the web interface for Jaeger. A security vulnerability exists in Jaeger UI versions prior to v.1.31.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the KeyValuesTable component...

CVE-2023-36656

CVE-2023-36656 affects Jaeger UI prior to version 1.31.0. The issue is a Cross-Site Scripting (XSS) vulnerability in the KeyValuesTable component that can allow a remote attacker to execute arbitrary code in a victim’s browser. Affected software: Jaeger UI. Root cause: unsanitized input handling ...

Cross-Site Scripting (XSS)

github.com/jaegertracing/jaeger and gloo-jaeger-ui are vulnerable to Cross-Site Scripting XSS attacks. The vulnerability is triggered when rendering key-value tables in jaeger UI using the KeyValuesTable component, which allows an attacker to inject and execute malicious javascript on a victim's...

GHSA-2W8W-QHG4-F78J A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r Summary Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable...

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r Summary Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable...

CVE-2023-36656

creationtimestamp| type| source ---|---|--- 2023-07-11 15:33:08+00:00| published-proof-of-concept| https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r 2023-07-11 15:40:38+00:00| published-proof-of-concept|...

Information leakage vulnerability in Jaeger Reports of Beijing Guo Torch Information Technology Co.

Beijing Guo Torch Information Technology Co., Ltd. is an information technology company engaged in computer software research and development, application and service, providing all-round support for large and medium-sized application system engineering. An information leakage vulnerability exist...

Fedora: Security Advisory for golang-github-uber-jaeger-client (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-uber-jaeger-client-2.30.0-3.fc36

Instrumentation library that implements an OpenTracing Tracer for Jaeger https://jaegertracing.io...

Fedora: Security Advisory for golang-github-uber-jaeger-client (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-uber-jaeger-client-2.30.0-2.fc36

Instrumentation library that implements an OpenTracing Tracer for Jaeger https://jaegertracing.io...

CVE-2021-22272

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch...

Design/Logic Flaw

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch...

CVE-2021-22272 ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch...

CVE-2021-22272

The CVE-2021-22272 entry concerns ABB/Busch-Jaeger ControlTouch cloud service. The root cause is in the commissioning flow, where an attacker could enter a serial number in a specific way to transfer the device virtually into the attacker’s my.busch-jaeger.de or mybuildings.abb.com profile, enabl...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.20.5 security update

An update is now available for Red Hat OpenShift Jaeger 1.20. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Low: Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.24.0 Operator/Operand Containers security update

An update is now available for Red Hat OpenShift Jaeger 1.24. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.20.4 security update

An update is now available for Red Hat OpenShift Jaeger 1.20. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.17.9 security update

An update is now available for Red Hat OpenShift Jaeger 1.17. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Information Exposure in jaeger

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials...