CVE-2023-40577 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

CVE-2023-40577

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

CVE-2023-40577

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

CVE-2023-40577

CVE-2023-40577 affects Prometheus Prometheus Alertmanager. The issue allows an attacker with POST permission on the /api/v1/alerts endpoint to cause arbitrary JavaScript execution in users of Alertmanager (stored XSS). The vulnerability is tied to the Alertmanager component handling incoming aler...

GHSA-V86X-5FM3-5P7J vulnerabilities

Vulnerabilities for packages: promxy, prometheus-alertmanager...

GHSA-V86X-5FM3-5P7J vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, promxy...

PT-2023-35948 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Invalid-free. The crash state involves several functions, including reset context and cmt decode...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the Google IAP details in Prometheus integration are not properly hidden, which leads to the leak of project settings, instance and group details to other users...

Server-Side Request Forgery (SSRF)

gitlab is vulnerable to Server-Side Request Forgery SSRF. This vulnerability occurs through the prometheus intergration in gitlab which could lead to a SRRF attack...

SUSE: Security Advisory (SUSE-SU-2023:3144-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, prometheus-mongodb-exporter-fips, prometheus-postgres-exporter, kube-oidc-proxy, prometheus-mongodb-exporter, yq, kube-logging-logging-operator, thanos-operator, kubernetes-dashboard, frp, tkn, buildkitd, kubernetes-csi-livenessprobe,...

AZL-35120 CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, prometheus-mongodb-exporter-fips, prometheus-postgres-exporter, kube-oidc-proxy, prometheus-mongodb-exporter, yq, kube-logging-logging-operator, thanos-operator, kubernetes-dashboard, frp, tkn, buildkitd, kubernetes-csi-livenessprobe,...

SUSE-SU-2023:3144-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler bsc1211741 prometheus-blackboxexporter: - Use obscpio for go modules service - Set version number - Set build date from SOURCEDATEEPOCH - Update to...

SUSE-SU-2023:3122-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler bsc1211741 kiwi-desc-saltboot: - Update to version 0.1.1687520761.cefb248 Add osimage cert package to bootstrap for SUSE Linux Enterprise 12 images...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability allows a crafted Prometheus Server query to cause high resource consumption which could lead to a system crash...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists in the Prometheus server bundled, allowing an attacker to cause an application crash...

Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.

Summary Netcool Operations Insight v1.6.9 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-42252 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by the failure to reject a request containing an invalid...

SUSE SLES15 / openSUSE 15 Security Update : prometheus-ha_cluster_exporter (SUSE-SU-2023:2799-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2799-1 advisory. - rebuild the package with the go 1.20 security release bsc1208296. Tenable has extracted the preceding description block...

SUSE SLES15 / openSUSE 15 Security Update : prometheus-sap_host_exporter (SUSE-SU-2023:2798-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2798-1 advisory. - rebuild the package with the go 1.20 security release bsc1208270. - fixed exporter package description bsc1211311. Tenable h...