Vulnerabilidades

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker…

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out…

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this…

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL,…

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent…

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a…

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has…

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and…

Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin…

The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the…

Vulnerabilidad de autorización faltante en Israpil Textmetrics webtexttool permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Textmetrics: desde n/a hasta <= 3.6.4.

El plugin ExactMetrics – Google Analytics Dashboard para WordPress es vulnerable a la Gestión Inadecuada de Privilegios en las versiones 7.1.0 a la 9.0.2. Esto se debe a que la función 'update_settings()' acepta nombres de configuración de plugin arbitrarios sin una lista blanca de configuraciones permitidas. Esto…

El plugin ExactMetrics – Google Analytics Dashboard para WordPress es vulnerable a Referencia Directa Insegura a Objeto en las versiones 8.6.0 a 9.0.2. Esto se debe a que el método 'store_settings()' en la clase 'ExactMetrics_Onboarding' acepta un parámetro 'triggered_by' proporcionado por el usuario que se utiliza en…

Neutralización Incorrecta de Etiquetas HTML Relacionadas con Scripts en una Página Web (XSS Básico) en Israpil Textmetrics webtexttool permite la Inyección de Código. Este problema afecta a Textmetrics: desde n/a hasta <= 3.6.3.

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits…

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots. Additionally,…

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and…

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could potentially…

El complemento SEO Metrics para WordPress es vulnerable a la escalada de privilegios debido a la falta de comprobaciones de autorización tanto en el controlador AJAX seo_metrics_handle_connect_button_click() como en la función seo_metrics_handle_custom_endpoint() en las versiones 1.0.5 a 1.0.15. Dado que la acción…

Desde Akka hasta 2.10.6, akka-cluster-metrics utiliza la serialización de Java para las métricas del clúster.

La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Israpil Textmetrics permite XSS almacenado. Este problema afecta a Textmetrics desde n/d hasta la versión 3.6.2.

La vulnerabilidad de falta de autorización en Israpil Textmetrics permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Textmetrics desde n/d hasta la versión 3.6.1.

Vulnerabilidad de falta de autorización en ExactMetrics ExactMetrics permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a ExactMetrics: desde n/a hasta 8.1.0.

Loway - CWE-204: Discrepancia de respuesta observable