2761 matches found
FIRST Announces CVSS 4.0 - New Vulnerability Scoring System
The Forum of Incident Response and Security Teams FIRST has officially announced CVSS v4.0, the next generation of the Common Vulnerability Scoring System standard, more than eight years after the release of CVSS v3.0 in June 2015. "This latest version of CVSS 4.0 seeks to provide the highest...
CVE-2023-45142
A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability. Mitigation As a workaround to stop being affected otelhttp.WithFilter can be used...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: prometheus-stackdriver-exporter, prometheus-adapter-fips, timestamp-authority-fips, bank-vaults-fips, aws-efs-csi-driver-fips, spark-operator, prometheus-blackbox-exporter, metrics-server-fips, dynamic-localpv-provisioner-fips, slsa-verifier, falcoctl-fips,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: aactl, kubescape, dgraph, buildkitd, src, kubevela, slsa-verifier, cortex, up, spark-operator, terraform-provider-sendgrid, k3d, kubeflow, scorecard...
Moderate: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this update as...
Moderate: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
ALSA-2023:5863 Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS...
Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 golang: net/http, x/net/http2: rapid stream resets can cause...
GHSA-RCJV-MGP8-QVMR vulnerabilities
Vulnerabilities for packages: buildkitd, kube-oidc-proxy, kubevela, kubernetes-fips, k3s, kubernetes, up, rancher-webhook, rancher-webhook-fips, metrics-server-fips, caddy, prometheus-adapter...
OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics
...
PT-2023-7334
Name of the Vulnerable Software and Affected Versions Knative Serving versions prior to 0.39.0 Knative Serving versions prior to v1.10.5 Knative Serving versions prior to v1.11.3 Knative Serving versions prior to v1.12.0 Description The issue is related to an unbound memory allocation bug in...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: buildkitd, kube-oidc-proxy, kubevela, kubernetes-fips, k3s, kubernetes, up, rancher-webhook, rancher-webhook-fips, metrics-server-fips, caddy, prometheus-adapter...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, yq, dex-k8s-authenticator, vertical-pod-autoscaler, prometheus-blackbox-exporter, metrics-server-fips, kubeflow-katib, falcoctl, kaf, secrets-store-csi-driver, atlantis-fips, flux, pulumi-kubernetes-operator,...
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, yq, dex-k8s-authenticator, vertical-pod-autoscaler, prometheus-blackbox-exporter, metrics-server-fips, kubeflow-katib, falcoctl, kaf, secrets-store-csi-driver, atlantis-fips, flux, pulumi-kubernetes-operator,...
CVE-2023-40141
In tempresidencynamestore of thermalmetrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Out-of-bounds
In tempresidencynamestore of thermalmetrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Google Pixel Buffer Error Vulnerability
Google Pixel is a smartphone from Google, Inc. in the United States. Google Pixel has a security vulnerability that stems from a lack of bounds checking in the tempresidencynamestore method of thermalmetrics.c, which may result in out-of-bounds writes. This could result in local privilege...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: nats, kubescape, grype, cortex, nodetaint, pulumi-language-java, cue, metrics-server, dgraph, flux-kustomize-controller, pulumi-language-yaml, aactl, aws-efs-csi-driver, rqlite, bom, frp, terraform-provider-azurerm, helm, nri-prometheus, k3d, weaviate, nghttp2,...
CVE-2023-43810
CVE-2023-43810 concerns OpenTelemetry instrumentation. Autoinstrumentation may expose an unbounded http_method label, enabling memory exhaustion under large numbers of crafted requests. Affected if the application is instrumented for HTTP handlers and does not filter non-standard methods at CDN/L...