CVE-2021-29622

CVE-2021-29622 affects Prometheus. A bug in the /new endpoint during the 2.23.0 UI migration allows an attacker to craft a URL that redirects users to an arbitrary address. The issue is mitigated by upgrading to versions that patch it (2.26.1 and 2.27.1) and by removing the /new endpoint in 2.28....

Prometheus 输入验证错误漏洞

Prometheus is an open source software written in the Go language for recording real-time metrics from time series databases built using the HTTP pull model. Prometheus suffers from an input validation error vulnerability that can be exploited by an attacker to redirect to any other URL...

R3: Exposed Prometheus instance at prometheus.qa.r3.com

Summary Hi there, just wanted to note that all of your assets are listed as out of scope on HackerOne right now, which is a bit confusing. Nevertheless, I noticed that your Prometheus server at prometheus.qa.r3.com is exposed to the internet, which appears to let you view all of the internal...

Prometheus -- arbitrary redirects

Prometheus reports: Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an...

SUSE SLES15 Security Update : ceph (SUSE-SU-2021:1473-1)

This update for ceph fixes the following issues : ceph was updated to 14.2.20-402-g6aa76c6815 : - CVE-2021-20288: Fixed unauthorized globalid reuse bsc1183074. - CVE-2020-25678: Do not add sensitive information in Ceph log files bsc1178905. - CVE-2020-27839: Use secure cookies to store JWT Token...

SUSE: Security Advisory (SUSE-SU-2020:1970-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GitLab server-side request forgery vulnerability (CNVD-2021-26068)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. GitLab suffers from a server-side request forgery vulnerability that can be exploited via Prometheu...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

UBUNTU-CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

Information disclosure

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

Removed by vendor...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

Summary: CVE-2021-22178 affects GitLab versions starting from 13.2 and earlier, due to a SRRF attack via the Prometheus integration. The connected sources consistently describe this as a vulnerability in GitLab exposing potential risks when Prometheus is enabled, but do not provide vendor-specifi...

PT-2021-14890 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.2 and later Description: An issue has been discovered in GitLab, making it vulnerable to a Server-Side Request Forgery SRRF attack through the Prometheus integration. Recommendations: For GitLab versions 13.2 and later, at...

GitLab 代码问题漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. GitLab suffers from a server-side request forgery vulnerability that can be exploited via Prometheu...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Improper Certificate Validation for Fortinet OTP Denial of Service Attack on gitlab-shell Resource exhaustion due to pending jobs Confidential issue titles were exposed Improper access control allowed demoted project members to access authored merge requests Improper access contro...

CentOS 8 : prometheus-jmx-exporter (CESA-2020:4807)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4807 advisory. - snakeyaml: Billion laughs attack via alias feature CVE-2017-18640 Note that Nessus has not tested for this issue but has instead relied only on the...