Fedora: Security Advisory (FEDORA-2023-0c6723004f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the file /api/v1/alerts of the Prometheus monitoring system, which is used to process alerts from Alertmanager, allows a perpetrator to execute arbitrary code.

The vulnerability of the Prometheus monitoring system’s /api/v1/alerts file for processing alerts by Alertmanager is related to improper handling of input data during the generation of web pages. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

ROS-20240827-17

Vulnerability in the /api/v1/alerts file of the Prometheus monitoring system component for processing alerts Alertmanager is related to incorrect neutralization of input data during web page generation. Exploitation of the vulnerability could allow an attacker to execute arbitrary code...

GO-2023-2020 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager...

Ubuntu: Security Advisory (USN-6935-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6935-1: Prometheus Alertmanager vulnerability

It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if...

USN-6935-1 prometheus-alertmanager vulnerability

It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Prometheus Alertmanager vulnerability (USN-6935-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6935-1 advisory. It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with...

GHSA-MH55-GQVF-XFWM vulnerabilities

Vulnerabilities for packages: rekor, timestamp-authority, grafana-mimir, datadog-agent, prometheus-alertmanager, cortex, fulcio...

OPENSUSE-SU-2024:13599-1 golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.26.0-4.1 package on the GA media of openSUSE Tumbleweed...

openSUSE Security Advisory (SUSE-SU-2024:0512-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for Golang Prometheus (SUSE-SU-2023:3888-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : golang-github-prometheus-alertmanager (SUSE-SU-2024:0512-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0512-1 advisory. golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 jscPED-7353: - Version 0.26.0: Security fixes: -...

SUSE-SU-2024:0512-1 Security update for golang-github-prometheus-alertmanager

This update for golang-github-prometheus-alertmanager fixes the following issues: golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 jscPED-7353: - Version 0.26.0: Security fixes: + CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI...

SUSE CVE-2023-40577

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in...

IBM: Improper Authentication on Alertmanager instance

Improper authentication was configured on an alertmanager instance. The issue was reported to IBM, analyzed, and remediated...

Fedora 39 : golang-github-prometheus-alertmanager (2023-0c6723004f)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0c6723004f advisory. Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39. Changelog Sat Apr 29 2023 Srgio M. Basto - 0.23.0-15 - Include s390x, and disable...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kpt, prometheus-pushgateway-fips, slsa-verifier, nodetaint, node-problem-detector, atlantis-fips, kube-fluentd-operator, stakater-reloader, dex, prometheus-alertmanager, falcoctl-fips, weaviate, prometheus-postgres-exporter, src, coredns, dex-k8s-authenticator,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kpt, prometheus-pushgateway-fips, slsa-verifier, nodetaint, node-problem-detector, atlantis-fips, kube-fluentd-operator, stakater-reloader, dex, prometheus-alertmanager, falcoctl-fips, weaviate, prometheus-postgres-exporter, src, coredns, dex-k8s-authenticator,...

Debian: Security Advisory (DLA-3609-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...