Important: amazon-cloudwatch-agent

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2851)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300054.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2851 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, nfs-subdir-external-provisioner, kubernetes-csi-livenessprobe, authservice, terraform-provider-tls, vault-k8s, kapp, kube-metrics-adapter, licenseclassifier, docker-cli, addon-resizer, overmind, grype, bom, trust-manager, pdfcpu, rootlesskit,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: buildah, spire-server, nfs-subdir-external-provisioner, kubernetes-csi-livenessprobe, authservice, terraform-provider-tls, vault-k8s, kapp, kube-metrics-adapter, licenseclassifier, docker-cli, addon-resizer, overmind, grype, bom, trust-manager, pdfcpu, rootlesskit,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: gotestsum, opentelemetry-collector-contrib-fips, syft, wire-go, consul, temporal-fips, kyverno-policy-reporter-kyverno-plugin, fq, rabbitmq-default-user-credential-updater, authservice, aws-signer-notation-plugin-fips, gh, prometheus-podman-exporter,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: gotestsum, opentelemetry-collector-contrib-fips, syft, wire-go, consul, temporal-fips, kyverno-policy-reporter-kyverno-plugin, fq, rabbitmq-default-user-credential-updater, authservice, aws-signer-notation-plugin-fips, gh, prometheus-podman-exporter,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: spire-server, gitsign, actions-runner-controller, zarf, fluent-bit-plugin-loki, rclone, step-ca, oauth2-proxy, pulumi, opentelemetry-operator, kube-metrics-adapter, filebrowser, timestamp-authority, bank-vaults, k3s, azcopy, jitsucom-bulker, pulumi-kubernetes-operato...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, consul, rekor, harbor-registry-fips, kubernetes-dashboard-auth-fips, loki, bank-vaults, thanos, azuredisk-csi-fips, guac, gitea, temporal-server-fips, tekton-chains, buildkitd-fips, grafana-agent-operator, azuredisk-csi, kyverno,...

Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2779)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300052.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2779 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause ...

CVE-2025-24970 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, trino, zookeeper, selenium, wildfly, docker-selenium, cassandra-reaper, celeborn, cloudwatch-exporter, akhq, management-api-for-apache-cassandra-5.0, kserve-modelmesh, thingsboard, apicurio-registry, strimzi-kafka-operator, keycloak, flyway,...

GHSA-4G8C-WM8X-JFHW vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, trino, zookeeper, selenium, wildfly, docker-selenium, cassandra-reaper, celeborn, cloudwatch-exporter, akhq, management-api-for-apache-cassandra-5.0, kserve-modelmesh, thingsboard, apicurio-registry, strimzi-kafka-operator, keycloak, flyway,...

AWS VDP: Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity...

AIOps - Revolutionizing Incident Management with Advanced Automation and LLM Integration

AIOps - Revolutionizing Incident Management with Advanced Automation and LLM Integration By Trellix · November 14, 2024 Contributed by Chalapathy Jampal, Siddhesh Shinde, Alagiri Annadurai, Lakshmi Ram Teja Eluri and Anil Pokhrel Managing infrastructure and applications across a complex IT...

CVE-2024-52314

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314

CVE-2024-52314 relates to data.all. Multiple connected sources describe a vulnerable scenario where a data.all admin team member with access to a customer‑owned AWS account can potentially extract user data from data.all application logs by scanning CloudWatch logs for operations interacting with...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data...

data.all 安全漏洞

data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that a member of the data.all management team with access to an AWS account owned by a customer deploying data.all may be able to extract user data...

PT-2024-35174 · Amazon +1 · Cloudwatch +2

Name of the Vulnerable Software and Affected Versions: data.all affected versions not specified Description: A data.all admin team member with access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs via CloudWatch log...