PT-2018-14554

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.0.0 through 11.2.7 GitLab Community and Enterprise Edition versions 11.3.0 through 11.3.8 GitLab Community and Enterprise Edition versions 11.4.0 through 11.4.3 Description An issue in GitLab...

Wallarm to Sponsor KubeCon + CloudNative Con

If you have not registered yet for the main Kubernetes event in North America which will start on December 10th in Seattle, you may be out of luck. The event is sold out and is only taking the waitlist applications. But if you are going, KubeCon + CloudNativeCon promises to be a treat with the...

Happy graduation, Envoy!

Envoy, the new darling of the DevOps community, performs the role of a service and edge proxy. With advanced features such as timeouts, rate limiting, circuit breaking, load balancing, retries, stats, logging, and distributed tracing are required to handle network failures in a fault tolerant and...

Wallarm joins CNCF to promote Kubernetes security

Wallarm has recently joined the Linux Foundation and its sister organization, Cloud Native Computing Foundation. Wallarm will be contributing its AI/ML security expertise within the LF and CNCF communities to support the sustainability and adoption of open source technologies. Wallarm and its...

Gitlab -- multiple vulnerabilities

Gitlab reports: RCE in Gitlab Wiki API SSRF in Hipchat integration Cleartext storage of personal access tokens Information exposure through stack trace error message Persistent XSS autocomplete Information exposure in stored browser history Information exposure when replying to issues through ema...

What’s New in Wallarm Node 2.10

We have recently released a new version of Wallarm Node. After your next update window, you will see some new features your DevOps team is certain to like. Firstly, your monitoring and reporting got a lot livelier. Starting with this version in addition to JSON format metrics can be exported in...

CVE-2018-14602

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames...

Information disclosure

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames...

CVE-2018-14602

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames...

CVE-2018-14602

Removed by vendor...

CVE-2018-14602

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames...

CVE-2018-14602

GitLab CE/EE prior to 10.8.7, 11.0.x prior to 11.0.5, and 11.1.x prior to 11.1.2 expose private project pathnames via the Prometheus metrics endpoint, causing information disclosure. Root cause: the metrics feature reveals sensitive path information. Impact: partial confidentiality loss for priva...

CVE-2018-14602: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames...

PT-2018-12608

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 10.8.7 GitLab Community and Enterprise Edition versions 11.0.x prior to 11.0.5 GitLab Community and Enterprise Edition versions 11.1.x prior to 11.1.2 Description An issue in the...

GitLab CE and EE Information Disclosure Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. An information...

Denial Of Service (DoS)

github.com/prometheus/prometheus is vulnerable to denial of service DoS attacks. The application does not restrict the size of a POST request body, allowing a malicious client to write an arbitrary amount of data to the server to cause an out-of-memory exception that can crash the application...

[SECURITY] Fedora 28 Update: python-prometheus_client-0.2.0-1.fc28

The Python client for Prometheus...

Slack: Information leakage and default open port

@freem0 found Prometheus plugin output that was exposed at one of our servers. The information exposed including some OS information metrics about memory usage, but no customer data was at risk and no exploit was possible. Thank you @freem0!...

Prometheus API Information Gather

This module utilizes Prometheus' API calls to gather information about the server's configuration, and targets. Fields which may contain credentials, or credential file names are then pulled out and printed. Targets may have a wealth of information, this module will print the following values whe...

Jason Orcutt Prometheus 3.0/4.0/6.0 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6087/info Prometheus is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Prometheus. An attacker may...