1660 matches found
Default configuration
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
PT-2023-7018 · Univention · Univention Corporate Server
Name of the Vulnerable Software and Affected Versions: Univention Corporate Server UCS versions 5.0-5 Description: The issue is related to the check univention joinstatus prometheus monitoring script, which reveals the LDAP plaintext password of the machine account in the process list. This allow...
CVE-2023-38994
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
GHSA-JQ35-85CJ-FJ4P vulnerabilities
Vulnerabilities for packages: kubescape, bom, k3s, slsa-verifier, k3d, aactl, skaffold, ctop, falcoctl-fips, tekton-chains, chartmuseum, up, kpt, paranoia, scorecard, rancher-agent, spire-server-fips...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: src, kubescape, spark-operator, kubevela, terraform-provider-sendgrid, aws-efs-csi-driver-fips, timestamp-authority-fips, prometheus-blackbox-exporter, bank-vaults-fips, kubeflow, cortex, prometheus-adapter-fips, kiam, slsa-verifier, falcoctl-fips,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: kubeflow, aactl, cortex, spark-operator, k3d, slsa-verifier, prometheus-blackbox-exporter, terraform-provider-sendgrid, scorecard, up, buildkitd, kubevela, dgraph, src, kubescape...
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics
Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...
GHSA-RCJV-MGP8-QVMR vulnerabilities
Vulnerabilities for packages: kubernetes-fips, kubernetes, kubevela, caddy, k3s, prometheus-adapter, rancher-webhook-fips, up, buildkitd, rancher-webhook, metrics-server-fips, kube-oidc-proxy...
Grafana Security Vulnerabilities
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: kubernetes-fips, kubernetes, kubevela, caddy, k3s, prometheus-adapter, rancher-webhook-fips, up, buildkitd, rancher-webhook, metrics-server-fips, kube-oidc-proxy...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: kubernetes, caddy, prometheus-adapter, k3s, up, buildkitd, kubevela...
AZL-35116 CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
AZL-50339 CVE-2023-39325 affecting package prometheus for versions less than 2.37.9-2
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: kube-state-metrics, kubevela, aws-efs-csi-driver-fips, tekton-chains, kubernetes-dashboard, thanos-operator, falcoctl, zot, slsa-verifier, wavefront-collector-for-kubernetes, sigstore-scaffolding, prometheus-operator, terraform, chartmuseum, rqlite,...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, amass, nfs-subdir-external-provisioner, metrics-server, falcoctl, flux-kustomize-controller, kaf, flux, ollama, dive, k3d, go, memcached-exporter, prometheus-alertmanager, hugo, k8sgpt-operator, spark-operator, kind, up, kube-logging-operator,...
AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: kube-state-metrics, kubevela, aws-efs-csi-driver-fips, tekton-chains, kubernetes-dashboard, thanos-operator, falcoctl, zot, slsa-verifier, wavefront-collector-for-kubernetes, sigstore-scaffolding, prometheus-operator, terraform, chartmuseum, rqlite,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: kube-state-metrics, kubevela, aws-efs-csi-driver-fips, nginx-stable, mc, certificate-transparency, slsa-verifier, sigstore-scaffolding, terraform, rqlite, nri-prometheus, kind, buildkitd, nginx-mainline, k3d, prometheus-postgres-exporter, dynamic-localpv-provisioner,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, amass, metrics-server, flux-kustomize-controller, kaf, ollama, k3d, memcached-exporter, hugo, spark-operator, kind, terraform, pulumi, kubernetes-csi-livenessprobe, slsa-verifier, nginx-mainline, terraform-provider-sendgrid, gitness,...