OPENSUSE-SU-2024:13599-1 golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.26.0-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12637-1 golang-github-prometheus-node_exporter-1.5.0-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-nodeexporter-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13604-1 golang-github-prometheus-prometheus-2.48.1-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-2.48.1-2.1 package on the GA media of openSUSE Tumbleweed...

Report Generation Fails with "lookup prometheus-server-exp: no such host"

Challenge After enabling Veeam Kasten for Kubernetes reports, reports are not generated. When running an on-demand report policy, the following error message is observed within the executor logs: "message":"Post "http://prometheus-server-exp:80/k10/prometheus/api/v1/query": dial tcp: lookup...

GHSA-M5VV-6R4H-3VJ9 vulnerabilities

Vulnerabilities for packages: flyte, guac, harbor-registry-fips, zarf, restic, bank-vaults-fips, opentelemetry-collector-contrib, hugo-extended, secrets-store-csi-driver-provider-azure, tekton-chains-fips, velero, py3-azure-identity, argo-events, falcoctl-fips, kubescape, ksops, hugo, argo-cd-fip...

AZL-42646 CVE-2024-35255 affecting package prometheus for versions less than 2.45.4-12

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: step, boring-registry, hugo-extended, cosign, cortex, grafana-agent-operator, pulumi, zot, thanos, up, opentelemetry-collector-contrib, tkn, tekton-chains, trino, spire-server, wal-g, zarf, sigstore-scaffolding, prometheus-operator, flux-kustomize-controller,...

[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.12.0-1.fc39

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 40 Update: prometheus-podman-exporter-1.12.0-1.fc40

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

Fedora: Security Advisory (FEDORA-2024-2f8a62d6d6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-1bae1999ba)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 39 : prometheus-podman-exporter (2024-1bae1999ba)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-1bae1999ba advisory. release 1.12.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Fedora 40 : prometheus-podman-exporter (2024-2f8a62d6d6)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2f8a62d6d6 advisory. release 1.12.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, kyverno-policy-reporter-kyverno-plugin, wavefront-collector-for-kubernetes, configmap-reload, wgcf, nvidia-nsight-compute-12.8, mkcert, metallb, gitsign, jsonnet-bundler, dive, thanos-operator, actions-runner-controller-fips,...

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12. A patched version of the package is available...

GitLab 13.2 < 13.6.7 / 13.7 < 13.7.7 / 13.8 < 13.8.4 (CVE-2021-22178)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. CVE-2021-22178 Note that Nessus has not teste...

GitLab 13.7 < 13.7.2 (CVE-2021-22166)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method CVE-2021-22166 Note that Nessus has not tested for this issue but has instead...

GHSA-XC3P-28HW-Q24G Grafana proxy Cross-site Scripting

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana. Release v.8.3.5, only containing security fixes: - Download Grafana 8.3.5 - Release notes Release v.7.5.15, only containing security fixes: - Download Grafana 7.5.15 -...

Security Bulletin: IBM Storage Fusion HCI is vulnerable to denial of service, authentication bypass, and incorrect privilege assignment due to Golang vulnerabilities.

Summary IBM Storage Fusion HCI uses Golang packages that may cause Fusion to be vulnerable to denial of service, authentication bypass, and incorrect privilege assignment. CVE-2018-20699, CVE-2023-48795, CVE-2022-21698, CVE-2021-41190, CVE-2023-39325, CVE-2022-29526, CVE-2023-45288. Vulnerability...

RHEL 7 : prometheus_client_golang (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - prometheus/clientgolang: Denial of service using InstrumentHandlerCounter CVE-2022-21698 Note that Nessus has not...