Authentication Bypass

github.com/grafana/agent is vulnerable to authentication bypass. The library does not properly restrict access to config endpoints, allowing an attacker to authenticate against a system for discovering Prometheus targets and collecting metrics leads to information disclosure...

CVE-2021-41090

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...

CVE-2021-41090

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...

Authentication flaw

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...

CVE-2021-41090 Instance config inline secret exposure

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...

SUSE-SU-2021:3908-1 Security Beta update for SUMA client tools

This update fixes the following issues: dracut-saltboot: - Fix dependencies of python libs bsc1188846 - Update to version 0.1.1628156312.dbd0dec - Force installation of libexpat.so.1 bsc1188846 - Update to version 0.1.1627546504.96a0b3e - Use kernel parameters from PXE formula also for local boot...

SUSE-SU-2021:3907-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: cobbler: - Fixed rce in the xmlrpc which additionally allowed arbirtrary file read and write as root bsc1189458 golang-github-prometheus-prometheus: - Provide and reload firewalld configuration only for: + openSUSE Leap 15.0, 15.1, 15.2 + SUSE SLE15, SLE15...

node_exporter -- bypass security with cache poisoning

Prometheus team reports: Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back...

SUSE-SU-2021:3621-1 Security update for SUSE Manager Server 4.1

This update fixes the following issues: grafana-formula: - Version 0.4.2 Add SSH blackbox status check panel to clients dashboard Migrate deprecated panels in clients dashboard prometheus-formula: - Version 0.3.4 Fix opening Prometheus ports on proxy - Version 0.3.3 Add Prometheus targets...

Prometheus Unauthorized Access Vulnerability

Prometheus is an open source event control and solution. prometheus unauthorized access vulnerability can be exploited by attackers to obtain sensitive information, /api/v1/status/flags of web.enable-admin-api and web-enable-lifecycle if True can shut down the service or delete all endpoints...

Experts Warn of Unprotected Prometheus Endpoints Exposing Sensitive Information

A large-scale unauthenticated scraping of publicly available and non-secured endpoints from older versions of Prometheus event monitoring and alerting solution could be leveraged to inadvertently leak sensitive information, according to the latest research. "Due to the fact that authentication an...

com.github.barambani:http4s-extend_2.11 (0.0.42), org.http4s:http4s-blaze-server_2.11 (0.18.16) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.16)

org.http4s:http4s-server2.11 MAVEN version 0.18.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 0.0.42 - org.http4s:http4s-blaze-server2.11 0.18.16 -...

io.isomarcte:http4s-active-requests-core_2.11 (>=0.0.1, <=0.0.3), org.http4s:http4s-blaze-server_2.11 (0.18.23) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.23)

org.http4s:http4s-server2.11 MAVEN version 0.18.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - io.isomarcte:http4s-active-requests-core2.11 =0.0.1, =0.0.3 - org.http4s:http4s-blaze-server2.11...

org.http4s:http4s-blaze-server_2.11 (0.18.20), org.http4s:http4s-jetty_2.11 (0.18.20) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.20)

org.http4s:http4s-server2.11 MAVEN version 0.18.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.18.20 - org.http4s:http4s-jetty2.11 0.18.20 -...

org.http4s:http4s-blaze-server_2.11 (0.19.0), org.http4s:http4s-jetty_2.11 (0.19.0) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.19.0)

org.http4s:http4s-server2.11 MAVEN version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.19.0 - org.http4s:http4s-jetty2.11 0.19.0 -...

com.github.barambani:http4s-extend_2.11 (>=0.0.27, <=0.0.28), org.http4s:http4s-blaze-server_2.11 (0.18.8) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.8)

org.http4s:http4s-server2.11 MAVEN version 0.18.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 =0.0.27, =0.0.28 - org.http4s:http4s-blaze-server2.11 0.18.8 -...

com.github.gvolpe:http4s-tracer_2.11 (>=1.0-m3, <=1.0-m4), org.http4s:http4s-blaze-server_2.11 (0.19.0-m2) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.19.0-m2)

org.http4s:http4s-server2.11 MAVEN version 0.19.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.github.gvolpe:http4s-tracer2.11 =1.0-m3, =1.0-m4 - org.http4s:http4s-blaze-server2.11 0.19.0-m2...

org.http4s:http4s-blaze-server_2.11 (0.18.24), org.http4s:http4s-jetty_2.11 (0.18.24) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.24)

org.http4s:http4s-server2.11 MAVEN version 0.18.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.18.24 - org.http4s:http4s-jetty2.11 0.18.24 -...

org.http4s:http4s-blaze-server_2.11 (0.18.25), org.http4s:http4s-jetty_2.11 (0.18.25) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.25)

org.http4s:http4s-server2.11 MAVEN version 0.18.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.18.25 - org.http4s:http4s-jetty2.11 0.18.25 -...

org.http4s:http4s-blaze-server_2.11 (0.18.26), org.http4s:http4s-jetty_2.11 (0.18.26) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.18.26)

org.http4s:http4s-server2.11 MAVEN version 0.18.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.18.26 - org.http4s:http4s-jetty2.11 0.18.26 -...