CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: spicedb, step-ca, k3s, amass, caddy, kots, trillian, kine, src, kube-bench, argo-workflows, ferretdb, step, temporal-server...

CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: step-ca, caddy, kots, trillian, argo-workflows, step...

BIT-ARGO-WORKFLOWS-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

BIT-ARGO-WORKFLOWS-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, certificate-transparency, kubernetes-dashboard-metrics-scraper, secrets-store-csi-driver-provider-gcp, crossplane-provider-aws-kms, grafana-operator, ollama, terraform-provider-sendgrid, kubevela, mc, kubernetes, newrelic-nri-kube-events,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, newrelic-infra-operator, nodetaint, bank-vaults, prometheus-bind-exporter, crossplane-provider-gcp, fulcio-fips, kyverno-policy-reporter, kine, hubble, temporal-server, kubernetes-csi-external-resizer, secrets-store-csi-driver-provider-azure,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: spicedb, step-ca, k3s, amass, caddy, kots, trillian, kine, src, kube-bench, argo-workflows, ferretdb, step, temporal-server...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: src, caddy, argo-workflows-fips, step-ca, ferretdb, kine, argo-workflows, temporal-server, amass, step, k3s, caddy-fips, temporal-server-fips, trillian, kots, wavefront-collector-for-kubernetes, spicedb, falcosidekick-fips, trillian-fips, kube-bench-fips, kube-bench...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: src, caddy, argo-workflows-fips, step-ca, ferretdb, kine, argo-workflows, temporal-server, amass, step, k3s, caddy-fips, temporal-server-fips, trillian, kots, wavefront-collector-for-kubernetes, spicedb, falcosidekick-fips, trillian-fips, kube-bench-fips, kube-bench...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: caddy-fips, argo-workflows, caddy, trillian, argo-workflows-fips, trillian-fips, step-ca, kots, step, wavefront-collector-for-kubernetes...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: ko-fips, up, falcoctl-fips, scorecard, zot, cosign, bom, cadvisor-fips, policy-controller, argo-workflows-fips, slsa-verifier, docker-credential-gcr, kpt, k8sgpt, docker-machine-driver-harvester, crane, rancher-machine, helm-operator-fips, helm-fips, cosign-fips,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: ko-fips, up, falcoctl-fips, scorecard, zot, cosign, bom, cadvisor-fips, policy-controller, argo-workflows-fips, slsa-verifier, docker-credential-gcr, kpt, k8sgpt, docker-machine-driver-harvester, crane, rancher-machine, helm-operator-fips, helm-fips, cosign-fips,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-events-fips, argo-workflows, pulumi-kubernetes-operator, flux-notification-controller, snyk-cli, argo-events, melange, task...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, argo-events, melange, pulumi-kubernetes-operator, snyk-cli, argo-workflows, task...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events-fips, argo-workflows, pulumi-kubernetes-operator, flux-notification-controller, snyk-cli, argo-events, melange, task...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, argo-events, melange, pulumi-kubernetes-operator, snyk-cli, argo-workflows, task...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Privilege Escalation

github.com/argoproj/argo-workflows is vulnerable to privilege escalation. An attacker can create a workflow through the newHTTPServer function of argoserver.go that produces an HTML artifact and makes XRL calls to the Argo Server API by using a script, allowing the attacker to send malicious emai...