CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: dagger, temporal-ui-server-fips, logstash-exporter-fips, flux-source-controller, kubernetes-dashboard-fips, flannel, skopeo, zot, dynamic-localpv-provisioner, logstash-exporter, flux-image-reflector-controller, boring-registry-fips, crossplane-provider-aws-iam,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: ferretdb, kube-bench, argo-workflows, kots, trillian, caddy, step-ca, kine, spicedb, step, temporal-server, amass, src, k3s...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: spicedb, src, trillian-fips, argo-workflows, k3s, argo-workflows-fips, caddy, wavefront-collector-for-kubernetes, kube-bench-fips, ferretdb, trillian, caddy-fips, kots, amass, kube-bench, kine, falcosidekick-fips, temporal-server, step-ca, temporal-server-fips, step...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: spicedb, src, trillian-fips, argo-workflows, k3s, argo-workflows-fips, caddy, wavefront-collector-for-kubernetes, kube-bench-fips, ferretdb, trillian, caddy-fips, kots, amass, kube-bench, kine, falcosidekick-fips, temporal-server, step-ca, temporal-server-fips, step...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: trillian-fips, wavefront-collector-for-kubernetes, argo-workflows, kots, step-ca, step, trillian, argo-workflows-fips, caddy-fips, caddy...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: ko-fips, cri-tools, nerdctl, argo-workflows, dagger, eksctl, kubevela, guac, k3s, kubeflow-katib, argo-workflows-fips, bom, skopeo, cadvisor-fips, aactl, up, newrelic-infrastructure-agent, kpt, policy-controller, zot, goreleaser, cadvisor, ctop, crane,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: ko-fips, cri-tools, nerdctl, argo-workflows, dagger, eksctl, kubevela, guac, k3s, kubeflow-katib, argo-workflows-fips, bom, skopeo, cadvisor-fips, aactl, up, newrelic-infrastructure-agent, kpt, policy-controller, zot, goreleaser, cadvisor, ctop, crane,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, argo-events, task, argo-workflows, snyk-cli, pulumi-kubernetes-operator, melange, argo-events-fips...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-workflows, flux-notification-controller, task, pulumi-kubernetes-operator, melange, snyk-cli, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-workflows, flux-notification-controller, task, pulumi-kubernetes-operator, melange, snyk-cli, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, argo-events, task, argo-workflows, snyk-cli, pulumi-kubernetes-operator, melange, argo-events-fips...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Privilege Escalation

github.com/argoproj/argo-workflows is vulnerable to privilege escalation. An attacker can create a workflow through the newHTTPServer function of argoserver.go that produces an HTML artifact and makes XRL calls to the Argo Server API by using a script, allowing the attacker to send malicious emai...

CVE-2022-29164

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Hardcoded credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Argo Workflows 安全漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Cloud Native Computing Foundation. A security vulnerability exists in Argo Workflows. An attacker can trick a victim into creating or deleting workflows through deception...

CVE-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

CVE-2022-29164

Affected software: Argo Workflows (Kubernetes) Vulnerability summary: An attacker can craft a HTML artifact in a workflow that contains a script using XHR to interact with the Argo Server API. The attacker emails a link to the deep-link artifact; when opened by a victim, the script executes with ...