289 matches found
CVE-2025-2786 Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...
CVE-2025-2842
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...
CVE-2025-2786
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...
PT-2025-14478
Name of the Vulnerable Software and Affected Versions Tempo Operator affected versions not specified Description A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allow...
Grafana Tempo operator 信息泄露漏洞
Grafana Tempo operator is a Grafana Tempo Kubernetes operator program open-sourced by Grafana. An information disclosure vulnerability exists in Grafana Tempo operator, which stems from the creation of a ServiceAccount that may disclose information about other user privileges...
Grafana Tempo operator 信息泄露漏洞
Grafana Tempo operator is a Grafana Tempo Kubernetes operator program open-sourced by Grafana. An information disclosure vulnerability exists in the Grafana Tempo operator, which stems from the possibility of disclosing cluster metrics when the Jaeger UI Monitor Tab feature is enabled...
PT-2025-14479
Name of the Vulnerable Software and Affected Versions Tempo Operator affected versions not specified Description A flaw was found in the Tempo Operator related to the Jaeger UI Monitor Tab functionality. When this functionality is enabled, the Operator creates a ClusterRoleBinding for the Service...
CVE-2025-30204 vulnerabilities
Vulnerabilities for packages: mc, zot, filebrowser, rook, secrets-store-csi-driver-provider-azure, chartmuseum, crossplane-provider-family-azure, guac, vexctl, kyverno-notation-aws, atlantis, crossplane, ko, policy-controller, temporal-server, gitness, opencost, flux-image-reflector-controller,...
GHSA-93MQ-9FFX-83M2 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, grafana-alloy, tempo, kargo, argo-rollouts, splunk-otel-collector, amazon-cloudwatch-agent, k8sgpt, opentelemetry-collector, opentelemetry-collector-contrib, argo-workflows, nats...
GHSA-93MQ-9FFX-83M2 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-fips, eks-distro-fips, argo-workflows, keda, opentelemetry-collector-contrib, argo-cd, eks-distro, grafana-alloy-fips, argo-cd-fips, amazon-cloudwatch-agent, grafana-alloy, tempo, k8sgpt, kubeflow-pipelines,...
CVE-2025-23868
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through = 0.9.5...
CVE-2025-23868 WordPress Chess Tempo Viewer plugin <= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through = 0.9.5...
CVE-2025-23868 WordPress Chess Tempo Viewer plugin <= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through = 0.9.5...
CVE-2025-23868
CVE-2025-23868 : Stored XSS in Chess Tempo Viewer (Markus Liebelt). Described as Improper Neutralization of Input During Web Page Generation; affects Chess Tempo Viewer versions from n/a through 0.9.5. CVSS v3.1 base score 6.5 (Medium) with NETWORK attack vector, low to moderate complexity, user ...
WordPress Chess Tempo Viewer plugin <= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerability
Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Chess Tempo Viewer versions = 0.9.5...
Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release
A new version of Red Hat OpenShift distributed tracing platform Tempo has been released Red Hat OpenShift distributed tracing platform based on Tempo. Tempo is an open-source, easy-to-use, and highly scalable distributed tracing backend. It provides observability for microservices architectures b...
WordPress plugin Chess Tempo Viewer 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-5154 · Markus Liebelt · Markus Liebelt Chess Tempo Viewer
Name of the Vulnerable Software and Affected Versions: Markus Liebelt Chess Tempo Viewer versions 0.9.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can injec...
Moderate: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release
A new version of Red Hat OpenShift distributed tracing platform Tempo has been released Red Hat OpenShift distributed tracing platform based on Tempo. Tempo is an open-source, easy-to-use, and highly scalable distributed tracing backend. It provides observability for microservices architectures b...