CVE-2022-46146 Prometheus Exporter Toolkit vulnerable to basic authentication bypass

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

PT-2022-6550

Name of the Vulnerable Software and Affected Versions Prometheus Exporter Toolkit versions prior to 0.7.2 and 0.8.2 Description The issue is related to the implementation of the bcrypt hashing algorithm in the Prometheus Exporter Toolkit, which can be exploited to bypass authentication when...

prometheus2 -- basic authentication bypass

Prometheus team reports: Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back...

WordPress WP CSV Exporter plugin <= 1.3.6 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection SQLi vulnerability discovered by Asif Nawaz Minhas in the WordPress WP CSV Exporter plugin versions = 1.3.6. Solution Update the WordPress WP CSV Exporter plugin to the latest available version at least 1.3.7...

WP CSV Exporter < 1.3.7 - Admin+ SQLi

The plugin does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks PoC As an admin, go to Tools CSV Export, leave everything as default and click on Export POSTS CSV Intercept the...

prometheus-jmx-exporter bug fix and enhancement update

An update is available for prometheus-jmx-exporter. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

The vulnerability of the PDF Templates Overview Page component of the Better PDF Exporter Add-on allows an attacker to execute XSS attacks.

The vulnerability of the PDF Templates Overview Page component of the Better PDF Exporter for Jira software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

AlmaLinux 8 : prometheus-jmx-exporter (ALSA-2022:6820)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6820 advisory. - The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service DoS due missing to nested depth limitation for collections...

Moderate: Red Hat Security Advisory: prometheus-jmx-exporter security update

An update for prometheus-jmx-exporter is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RLSA-2022:6820 Moderate: prometheus-jmx-exporter security update

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-25857 For more details about the security issues,...

prometheus-jmx-exporter security update

An update is available for prometheus-jmx-exporter. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Prometheus JMX Exporter is a JMX to Prometheus exporter: a...

Moderate: prometheus-jmx-exporter security update

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-25857 For more details about the security issues,...

prometheus-jmx-exporter security update

0.12.0-8 - Bump snakeyaml version to 1.32 to collect fix for CVE-2022-25857 BZ 2128477...

ALSA-2022:6820 Moderate: prometheus-jmx-exporter security update

Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security Fixes: snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-25857 For more details about the security issues,...

RHEL 8 : prometheus-jmx-exporter (RHSA-2022:6820)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6820 advisory. Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Security...

Oracle Linux 8 : prometheus-jmx-exporter (ELSA-2022-6820)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6820 advisory. 0.12.0-8 - Bump snakeyaml version to 1.32 to collect fix for CVE-2022-25857 BZ 2128477 Tenable has extracted the preceding description block directly from the...

SUSE-SU-2022:3382-1 Security update for permissions

This update for permissions fixes the following issues: - CVE-2022-31252: Fixed chkstat group controlled paths bsc1203018. - Add capability for prometheus-blackboxexporter bsc1191194. - Make btmp root:utmp bsc1050467...

CVE-2022-3026

The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that...

CVE-2022-3026

The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that...

Input validation

The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that...