CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...

PT-2024-17656

Name of the Vulnerable Software and Affected Versions: Open Design Alliance CDE inWEB SDK versions prior to 2025.3 Description: A vulnerability was discovered that allows exposure of sensitive information to an unauthorized actor. Installing CDE Server with default settings enables unauthorized...

Open Design Alliance CDE inWEB SDK 安全漏洞

Open Design Alliance CDE inWEB SDK is an application organized by the Open Design Alliance ODA. Web application for editing, creating and viewing DWGs. A security vulnerability exists in versions of the Open Design Alliance CDE inWEB SDK prior to 2025.3, which arises from the installation of CDE...

CVE-2024-12564: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...

Moderate: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 3.3.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

openSUSE: Security Advisory for the Linux Kernel (Live Patch 44 for SLE 15 SP3) (SUSE-SU-2024:4180-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kernel: tcp_metrics: validate source addr length

A vulnerability was found in the Linux kernel's tcpmetrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read out of boundary read...

kernel: tcp_metrics: validate source addr length

A vulnerability was found in the Linux kernel's tcpmetrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read out of boundary read...

kernel: tcp_metrics: validate source addr length

A vulnerability was found in the Linux kernel's tcpmetrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read out of boundary read...

This Week in Spring - November 26th, 2024

This Week in Spring - November 26th, 2024 Hi, Spring fans! Welcome to another installment of This Week in Spring! Happy Spring Boot 3.4 release month to those who celebrate! And, also, Happy Thanksgiving to those who celebrate! Spring Boot 3.4 brings with it long-anticipated updates to the entire...

CVE-2024-50221

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangoghtablesinit is not large enough for the memset done in smucmninitsoftgpumetrics. Condensed report follows:...

Timing Attack

Overview authentik-client is an authentik Affected versions of this package are vulnerable to Timing Attack due to the usage of a non-constant time comparison for the /-/metrics/ endpoint. An attacker can brute-force the SECRETKEY, which is used to authenticate the endpoint, by observing the time...

CVE-2024-52307

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307

CVE-2024-52307 affects the open-source identity provider authentik. A non-constant time comparison on the per-tenant/endpoint path "/-/metrics/" enables brute-forcing the SECRET_KEY used to authenticate that endpoint. The metrics endpoint serves Prometheus data and is not intended for public acce...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307: Observable Timing Discrepancy

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

PT-2024-35168

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.8.5 authentik version 2024.10.3 Description The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the SECRET KEY used to...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

PT-2025-2948 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to "/api/metrics/snapshot". This can be carried out by users with...