GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-csi, newrelic-k8s-metadata-injection, kafka-proxy, crossplane-provider-aws-dynamodb, neuvector-scanner, hey, cass-operator, crossplane-provider-aws-sns, kube-metrics-adapter, envoy-ratelimit, sriov-network-device-plugin, zot, buildkitd, tkn,...

AZL-54398 CVE-2024-45338 affecting package prometheus-adapter for versions less than 0.12.0-2

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54522 CVE-2024-45338 affecting package prometheus-adapter for versions less than 0.10.0-16

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

Low: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.4 security and bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.16.4 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online

Cybersecurity researchers are warning that thousands of servers hosting the Prometheus monitoring and alerting toolkit are at risk of information leakage and exposure to denial-of-service DoS as well as remote code execution RCE attacks. "Prometheus servers or exporters, often lacking proper...

CVE-2024-12564

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...

CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...

CVE-2024-45337 vulnerabilities

Vulnerabilities for packages: terragrunt, beats, cloudprober, gptscript, kubernetes-dashboard-web-fips, vault-k8s, cilium-cli, local-path-provisioner, cortex, eks-distro, grpc-health-probe, dex, sqlexporter-fips, bank-vaults-fips, kubewatch, grype, flux-kustomize-controller, gobuster,...

PT-2024-17656

Name of the Vulnerable Software and Affected Versions: Open Design Alliance CDE inWEB SDK versions prior to 2025.3 Description: A vulnerability was discovered that allows exposure of sensitive information to an unauthorized actor. Installing CDE Server with default settings enables unauthorized...

CVE-2024-12564: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...

Open Design Alliance CDE inWEB SDK 安全漏洞

Open Design Alliance CDE inWEB SDK is an application organized by the Open Design Alliance ODA. Web application for editing, creating and viewing DWGs. A security vulnerability exists in versions of the Open Design Alliance CDE inWEB SDK prior to 2025.3, which arises from the installation of CDE...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: terragrunt, beats, cloudprober, gptscript, kubernetes-dashboard-web-fips, vault-k8s, cilium-cli, local-path-provisioner, cortex, eks-distro, grpc-health-probe, dex, sqlexporter-fips, bank-vaults-fips, kubewatch, grype, flux-kustomize-controller, gobuster,...

Moderate: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 3.3.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

CVE-2024-24786 affecting package prometheus for versions less than 2.45.4-6

CVE-2024-24786 affecting package prometheus for versions less than 2.45.4-6. A patched version of the package is available...

Malicious code in fe-prometheus-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985893f86a88110b578b46b480afeeea3cece69b7d81e7ce6c54a5bb36d54ed7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fe-prometheus-report

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-11038 Malicious code in fe-prometheus-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985893f86a88110b578b46b480afeeea3cece69b7d81e7ce6c54a5bb36d54ed7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...