Improper Removal of Sensitive Information Before Storage or Transfer

Overview OpenTelemetry.Instrumentation.Http is a Http instrumentation for OpenTelemetry .NET Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the logging of sensitive query parameters by default. This behavior occurs...

@ai-em/opentelemetry-nestjs (=5.0.0), @amplication/opentelemetry-nestjs (>=1.0.0 <=4.2.1) +258 more potentially affected by unknown CVE via @opentelemetry/instrumentation (>=0.40.0 <=0.41.1)

@opentelemetry/instrumentation NPM version =0.40.0, =1.0.0, =1.0.14, =1.0.20, =3.0.1, =0.0.0-2023-07-27--11-15, =0.0.1, =0.0.0-alpha.20230501.1, =1.0.0-alpha.20230614.2, =0.1.2, =1.0.0, =2.3.95, =1.0.2-beta.0, =1.0.2-beta.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F8PQ-3926-8GX...

GHSA-F8PQ-3926-8GX5 Unsanitized user controlled input in module generation

Impact The import-in-the-middle loader used by @opentelemetry/instrumentation works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes...

PT-2023-33013 · Opentelemetry · @Opentelemetry/Instrumentation

Name of the Vulnerable Software and Affected Versions: @opentelemetry/instrumentation versions prior to 0.41.2 Description: The issue allows for remote code execution when user-supplied input is passed directly to an import function. This is due to the import-in-the-middle loader generating a...

Malicious code in opentelemetry-instrumentation-azure-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc696b261d62c4ba710dfcb144ebd204e3452a65dddf5385fca6012e46ded8d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...