1850 matches found
Grafana Security Vulnerabilities
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: up, kubernetes, k3s, caddy, buildkitd, prometheus-adapter, kubevela...
CVE-2023-45142 vulnerabilities
Vulnerabilities for packages: up, k3s, caddy, kubernetes, kubernetes-fips, metrics-server-fips, rancher-webhook, rancher-webhook-fips, kubevela, buildkitd, prometheus-adapter, kube-oidc-proxy...
AZL-35116 CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
AZL-50339 CVE-2023-39325 affecting package prometheus for versions less than 2.37.9-2
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: vault-csi-provider, kube-state-metrics, kube-state-metrics-fips, cosign, mc, git-lfs, vertical-pod-autoscaler, runc, aactl, dgraph, gke-gcloud-auth-plugin, tkn, wireguard-go, helm, flux-image-reflector-controller, kubernetes-csi-livenessprobe-fips, kubeflow, gomplate...
AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: gke-gcloud-auth-plugin, vault-k8s, kubeflow, runc, src, prometheus-alertmanager, nodetaint, pulumi-language-java, kubernetes-dashboard-metrics-scraper, dgraph, kube-state-metrics, cosign, newrelic-infrastructure-agent, oauth2-proxy, minio,...
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: vault-csi-provider, kube-state-metrics, kube-state-metrics-fips, cosign, mc, git-lfs, vertical-pod-autoscaler, runc, aactl, dgraph, gke-gcloud-auth-plugin, tkn, wireguard-go, helm, flux-image-reflector-controller, kubernetes-csi-livenessprobe-fips, kubeflow, gomplate...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: vault-csi-provider, kube-state-metrics, certificate-transparency, cosign, mc, git-lfs, aactl, grype, dgraph, gke-gcloud-auth-plugin, wireguard-go, helm, kubernetes-csi-livenessprobe-fips, ip-masq-agent, gomplate, kubeflow, newrelic-infrastructure-agent,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: scorecard, gke-gcloud-auth-plugin, nginx-stable, kubeflow, src, nodetaint, pulumi-language-java, terraform-provider-aws, dgraph, cosign, grype, terraform-provider-azurerm, newrelic-infrastructure-agent, oauth2-proxy, minio, kind, dex, kots, metacontroller,...
AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
CVE-2023-44487 vulnerabilities
Vulnerabilities for packages: scorecard, gke-gcloud-auth-plugin, nginx-stable, kubeflow, src, nodetaint, pulumi-language-java, terraform-provider-aws, dgraph, cosign, grype, terraform-provider-azurerm, newrelic-infrastructure-agent, oauth2-proxy, minio, kind, dex, kots, metacontroller,...
AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31341 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
Debian: Security Advisory (DLA-3609-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 3609-1] prometheus-alertmanager security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3609-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaries October 08, 2023 https://wiki.debian.org/LTS -...