https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:01:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-06600 bdu:2024-06600 https://cve.radiocsirt.org/vuln/bdu:2024-06600 https://cve.radiocsirt.org/vuln/bit-alertmanager-2023-40577 <p><strong>Affected:</strong> Bitnami: alertmanager</p> <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> <p><strong>Affected:</strong> Bitnami: alertmanager</p> <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> https://cve.radiocsirt.org/vuln/bit-alertmanager-2023-40577 https://cve.radiocsirt.org/vuln/cleanstart-2025-uv88153 <p><strong>Affected:</strong> CleanStart: alertmanager</p> <p>Security vulnerability affects the alertmanager package. Alertmanager handles alerts sent by client applications such as the Prometheus server.</p> <p><strong>Affected:</strong> CleanStart: alertmanager</p> <p>Security vulnerability affects the alertmanager package. Alertmanager handles alerts sent by client applications such as the Prometheus server.</p> https://cve.radiocsirt.org/vuln/cleanstart-2025-uv88153 https://cve.radiocsirt.org/vuln/euvd-2026-216766 EUVD-2026-216766 https://cve.radiocsirt.org/vuln/euvd-2026-216766 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40577 <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-40577 https://cve.radiocsirt.org/vuln/ghsa-v86x-5fm3-5p7j <p><strong>Affected:</strong> Go: github.com/prometheus/alertmanager</p> <p>### Impact</p> <p>An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.</p> <p>### Patches</p> <p>Users can upgrade to Alertmanager v0.2.51.</p> <p>### Workarounds</p> <p>Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.</p> <p>### References</p> <p>N/A</p> <p><strong>Affected:</strong> Go: github.com/prometheus/alertmanager</p> <p>### Impact</p> <p>An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.</p> <p>### Patches</p> <p>Users can upgrade to Alertmanager v0.2.51.</p> <p>### Workarounds</p> <p>Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.</p> <p>### References</p> <p>N/A</p> https://cve.radiocsirt.org/vuln/ghsa-v86x-5fm3-5p7j https://cve.radiocsirt.org/vuln/gsd-2023-40577 gsd-2023-40577 https://cve.radiocsirt.org/vuln/gsd-2023-40577 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13599-1 <p>golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media</p> <p>golang-github-prometheus-alertmanager-0.26.0-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13599-1 https://cve.radiocsirt.org/vuln/rhsa-2023:7198 <p>golang.org/x/net/html: Cross site scripting follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() rekor: compressed archives can result in OOM conditions goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests prometheus-alertmanager: UI is vulnerable to stored XSS via the /api/v1/alerts endpoint HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) opentelemetry: DoS vulnerability in otelhttp golang: cmd/go: Protocol Fallback when fetching modules opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics ssh: Prefix truncation attack on Binary Packet Protocol (BPP) go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients</p> <p>golang.org/x/net/html: Cross site scripting follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() rekor: compressed archives can result in OOM conditions goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests prometheus-alertmanager: UI is vulnerable to stored XSS via the /api/v1/alerts endpoint HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) opentelemetry: DoS vulnerability in otelhttp golang: cmd/go: Protocol Fallback when fetching modules opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics ssh: Prefix truncation attack on Binary Packet Protocol (BPP) go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients</p> https://cve.radiocsirt.org/vuln/rhsa-2023:7198 https://cve.radiocsirt.org/vuln/suse-su-2024:0191-1 <p>Security Beta update for SUSE Manager Client Tools</p> <p>Security Beta update for SUSE Manager Client Tools</p> https://cve.radiocsirt.org/vuln/suse-su-2024:0191-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-40577 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: prometheus-alertmanager, Ubuntu:20.04:LTS: prometheus-alertmanager, Ubuntu:Pro:22.04:LTS: prometheus-alertmanager</p> <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: prometheus-alertmanager, Ubuntu:20.04:LTS: prometheus-alertmanager, Ubuntu:Pro:22.04:LTS: prometheus-alertmanager</p> <p>Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-40577 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0148 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0148