2054 matches found
CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication
Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...
CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication
Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...
PT-2023-32468 · Yugabyte · Yugabytedb Anywhere
Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere affected versions not specified Description: The issue concerns Prometheus metrics being available without authentication, exposing detailed and sensitive information about the YugabyteDB Anywhere environment...
CVE-2023-6001: Exposure of Sensitive Information to an Unauthorized Actor
Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...
Fedora 39 : golang-github-prometheus-alertmanager (2023-0c6723004f)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0c6723004f advisory. Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39. Changelog Sat Apr 29 2023 Srgio M. Basto - 0.23.0-15 - Include s390x, and disable...
Fedora 39 : golang-github-prometheus-exporter-toolkit / etc (2023-cf176d02d8)
The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-cf176d02d8 advisory. Security fix for CVE-2022-46146, update to v0.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...
Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)
The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...
CVE-2023-38994
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
Default configuration
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
CVE-2023-38994
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
PT-2023-7018 · Univention · Univention Corporate Server
Name of the Vulnerable Software and Affected Versions: Univention Corporate Server UCS versions 5.0-5 Description: The issue is related to the check univention joinstatus prometheus monitoring script, which reveals the LDAP plaintext password of the machine account in the process list. This allow...
GHSA-JQ35-85CJ-FJ4P vulnerabilities
Vulnerabilities for packages: aactl, falcoctl-fips, spire-server-fips, chartmuseum, tekton-chains, kubescape, k3s, paranoia, slsa-verifier, k3d, up, scorecard, bom, skaffold, ctop, kpt...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: vault-csi-provider, prometheus-adapter-fips, buildkitd, volume-modifier-for-k8s-fips, k3d, dynamic-localpv-provisioner-fips, kube-oidc-proxy, terraform-provider-sendgrid, kubeflow-fips, aactl, prometheus-stackdriver-exporter, falcoctl-fips, kiam, slsa-verifier, up,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: cortex, kubevela, spark-operator, src, up, buildkitd, slsa-verifier, k3d, scorecard, aactl, kubescape, dgraph, terraform-provider-sendgrid, kubeflow...
GHSA-RCJV-MGP8-QVMR vulnerabilities
Vulnerabilities for packages: metrics-server-fips, kubevela, buildkitd, k3s, rancher-webhook, up, prometheus-adapter, kube-oidc-proxy, kubernetes, caddy, kubernetes-fips, rancher-webhook-fips...
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics
Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...
Grafana Security Vulnerabilities
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: metrics-server-fips, kubevela, buildkitd, k3s, rancher-webhook, up, prometheus-adapter, kube-oidc-proxy, kubernetes, caddy, kubernetes-fips, rancher-webhook-fips...