mosquitto:broker_fuzz_password_file: Bad-cast to UT_hash_bucket' (aka 'struct UT_hash_bucket')password_file__cleanup in mosquitto_security_cleanup_default

Project: https://github.com/eclipse/mosquitto.git Detailed Report: https://oss-fuzz.com/testcase?key=4659901361356800 Project: mosquitto Fuzzing Engine: libFuzzer Fuzz Target: brokerfuzzpasswordfile Job Type: libfuzzerubsanmosquitto Platform Id: linux Crash Type: Bad-cast Crash Address:...

CVE-2021-31232

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...

CVE-2021-31231

The CVE affects Grafana Enterprise Metrics versions before 1.2.1 and Grafana Metrics Enterprise 1.2.1. It is a local file disclosure vulnerability triggered when experimental.alertmanager.enable-api is enabled. The HTTP basic auth password_file can be exploited to exfiltrate any file content via ...

CVE-2021-31231: Undefined Security Weakness

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The...