GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, ip-masq-agent, spark-operator, prometheus-adapter, nodetaint, aws-efs-csi-driver...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, ip-masq-agent, spark-operator, prometheus-adapter, nodetaint, aws-efs-csi-driver...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: nodetaint, aws-efs-csi-driver-fips, ip-masq-agent, spark-operator, aws-ebs-csi-driver, aws-efs-csi-driver, kubernetes-dns-node-cache, prometheus-adapter...

CVE-2023-6001

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment...

PT-2023-32468 · Yugabyte · Yugabytedb Anywhere

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere affected versions not specified Description: The issue concerns Prometheus metrics being available without authentication, exposing detailed and sensitive information about the YugabyteDB Anywhere environment...

Fedora 39 : golang-github-prometheus-alertmanager (2023-0c6723004f)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0c6723004f advisory. Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39. Changelog Sat Apr 29 2023 Srgio M. Basto - 0.23.0-15 - Include s390x, and disable...

Fedora 39 : golang-github-prometheus-exporter-toolkit / etc (2023-cf176d02d8)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-cf176d02d8 advisory. Security fix for CVE-2022-46146, update to v0.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...

CVE-2023-38994

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

Default configuration

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

PT-2023-7018 · Univention · Univention Corporate Server

Name of the Vulnerable Software and Affected Versions: Univention Corporate Server UCS versions 5.0-5 Description: The issue is related to the check univention joinstatus prometheus monitoring script, which reveals the LDAP plaintext password of the machine account in the process list. This allow...

CVE-2023-38994

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: aactl, kubescape, falcoctl-fips, spire-server-fips, tekton-chains, chartmuseum, up, k3d, kpt, ctop, scorecard, slsa-verifier, paranoia, k3s, skaffold, bom...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, src, spark-operator, terraform-provider-sendgrid-fips, smarter-device-manager-fips, dynamic-localpv-provisioner-fips, plutono-fips, aactl, kiam, metrics-server-fips, kubeflow-fips, k3d, kube-oidc-proxy, bank-vaults-fips, slsa-verifier,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: up, src, buildkitd, k3d, kubevela, kubescape, cortex, kubeflow, spark-operator, aactl, slsa-verifier, dgraph, terraform-provider-sendgrid, scorecard...

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: rancher-webhook, buildkitd, metrics-server-fips, up, kube-oidc-proxy, kubernetes-fips, rancher-webhook-fips, kubernetes, caddy, kubevela, k3s, prometheus-adapter...