CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: kots, spicedb, caddy, amass, src, step-ca, ferretdb, argo-workflows, kube-bench, temporal-server, k3s, kine, step, trillian...

CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: kots, caddy, step-ca, argo-workflows, step, trillian...

BIT-ARGO-WORKFLOWS-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

BIT-ARGO-WORKFLOWS-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: osv-scanner, crossplane, kubernetes-dashboard, terraform-docs, cri-tools, buf, envoy-ratelimit, crossplane-provider-aws-memorydb, ctop, kubescape, crossplane-provider-aws-sqs, terraform-provider-aws, helm-operator, vault-k8s, kubeflow-katib, aactl, aws-efs-csi-driver...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: nerdctl, flux-helm-controller, request-1279, up, haproxy-ingress, caddy-fips, kubernetes-csi-external-provisioner, trillian-fips, policy-controller, weaviate, buildkitd, dagger, hugo-extended, crossplane-provider-family-azure, kwok, trillian, ferretdb,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: kots, spicedb, caddy, amass, src, step-ca, ferretdb, argo-workflows, kube-bench, temporal-server, k3s, kine, step, trillian...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kine, wavefront-collector-for-kubernetes, falcosidekick-fips, amass, spicedb, temporal-server, caddy-fips, caddy, trillian-fips, argo-workflows, kube-bench-fips, temporal-server-fips, step, kots, trillian, ferretdb, k3s, kube-bench, step-ca, src...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kine, wavefront-collector-for-kubernetes, falcosidekick-fips, amass, spicedb, temporal-server, caddy-fips, caddy, trillian-fips, argo-workflows, kube-bench-fips, temporal-server-fips, step, kots, trillian, ferretdb, k3s, kube-bench, step-ca, src...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, trillian, wavefront-collector-for-kubernetes, argo-workflows, caddy-fips, step-ca, caddy, step, trillian-fips, kots...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, nerdctl, aactl, helm-fips, flux-helm-controller, gitsign, kubeflow-katib, helm, trivy, zarf, pulumi, zot, k8sgpt, slsa-verifier, tekton-chains, helm-operator-fips, k3d, kargo, kubescape, skaffold, up, chartmuseum, falcoctl, guac,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, nerdctl, aactl, helm-fips, flux-helm-controller, gitsign, kubeflow-katib, helm, trivy, zarf, pulumi, zot, k8sgpt, slsa-verifier, tekton-chains, helm-operator-fips, k3d, kargo, kubescape, skaffold, up, chartmuseum, falcoctl, guac,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-events-fips, snyk-cli, melange, argo-workflows, pulumi-kubernetes-operator, argo-events, flux-notification-controller, task...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, melange, argo-workflows, argo-events, flux-notification-controller, task, snyk-cli...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events-fips, snyk-cli, melange, argo-workflows, pulumi-kubernetes-operator, argo-events, flux-notification-controller, task...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, melange, argo-workflows, argo-events, flux-notification-controller, task, snyk-cli...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Privilege Escalation

github.com/argoproj/argo-workflows is vulnerable to privilege escalation. An attacker can create a workflow through the newHTTPServer function of argoserver.go that produces an HTML artifact and makes XRL calls to the Argo Server API by using a script, allowing the attacker to send malicious emai...