BIT-GITLAB-2022-4289

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users...

BIT-GITLAB-2023-1733

A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1...

BIT-RABBITMQ-2021-32718 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

BIT-PROMETHEUS-2021-29622 Arbitrary redirects under /new endpoint

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirec...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-rds, smarter-device-manager, spark-operator, buildkitd, step, dgraph, configmap-reload, crossplane-provider-aws-kinesis, crossplane-provider-aws-elasticache, falcoctl, helm, metacontroller, skaffold,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, goreleaser, docker-compose, logstash-exporter-fips, cortex, pulumi-kubernetes-operator, rclone, minio-fips, tigera-operator, vault-csi-provider, crossplane-provider-aws-firehose, frp, atlantis-fips,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, chainctl, rabbitmq-cluster-operator, goreleaser, vault-k8s-fips, govulncheck, vite, jsonnet-bundler, logstash-exporter-fips, docker-credential-ecr-login, cue, litefs, nri-apache, cortex, aws-load-balancer-controller, nats,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, chainctl, rabbitmq-cluster-operator, goreleaser, vault-k8s-fips, govulncheck, vite, jsonnet-bundler, logstash-exporter-fips, docker-credential-ecr-login, cue, litefs, nri-apache, cortex, aws-load-balancer-controller, nats,...

AZL-35594 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35671 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, goreleaser, docker-compose, logstash-exporter-fips, cortex, pulumi-kubernetes-operator, rclone, minio-fips, tigera-operator, vault-csi-provider, crossplane-provider-aws-firehose, frp, atlantis-fips,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: smarter-device-manager, spark-operator, buildkitd, dgraph, configmap-reload, helm, vt-cli, aws-flb-firehose, skaffold, mongo-tools, pulumi-language-java, esbuild, k8sgpt, go-bindata, nri-nginx, sonobuoy, kube-bench, temporal-server, kubewatch, flux-helm-controller,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: smarter-device-manager, spark-operator, buildkitd, dgraph, configmap-reload, helm, vt-cli, aws-flb-firehose, skaffold, mongo-tools, pulumi-language-java, esbuild, k8sgpt, go-bindata, nri-nginx, sonobuoy, kube-bench, temporal-server, kubewatch, flux-helm-controller,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, chainctl, rabbitmq-cluster-operator, goreleaser, vault-k8s-fips, govulncheck, vite, jsonnet-bundler, logstash-exporter-fips, docker-credential-ecr-login, cue, litefs, nri-apache, cortex, aws-load-balancer-controller, nats,...

AZL-35670 CVE-2024-24786 affecting package prometheus for versions less than 2.45.4-6

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35593 CVE-2024-24786 affecting package prometheus for versions less than 2.37.9-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

openSUSE: Security Advisory for SUSE Manager Client Tools (SUSE-SU-2023:3144-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for Golang Prometheus (SUSE-SU-2023:3888-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for golang (SUSE-SU-2023:2598-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for SUSE Manager Client Tools (SUSE-SU-2023:3868-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...