prometheus

7 results · Clear filters · Feed

• Medium 5.3
  CVE-2025-11065

  Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

  A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat OpenShift Container Platform 4 Linux Debian Ubuntu Azure Linux Wolfi Go
  Jan 26, 2026
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025
• Medium 6.0
  CVE-2024-6104

  go-retryablehttp can leak basic auth credentials to log files

  go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

  HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jun 24, 2024
• Medium 5.5
  CVE-2024-35255

  Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

  Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

  Microsoft Azure Identity Library for .NET Microsoft Authentication Library Azure Identity Library Azure Linux Wolfi npm Maven PyPI Go NuGet
  Jun 11, 2024
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Medium 5.3
  CVE-2022-29526

  golang.org/x/sys/unix has Incorrect privilege reporting in syscall

  Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

  golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 22, 2022
• Medium 6.5
  CVE-2021-29622 Scanner template EPSS 20%

  Arbitrary redirects under /new endpoint

  Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an att…

  prometheus prometheus prometheus prometheus Ubuntu Azure Linux Alpine
  May 19, 2021