Improper Cache Handling

gitHub.com/coredns/coredns is vulnerable to Improper Cache Handling. The vulnerability is due to the CD bit disabling validation in the remote server which could allow an attacker to retrieve sensitive information cached erroneously, leading to information disclosure or unauthorized access...

GHSA-PXHW-596R-RWQ5 vulnerabilities

Vulnerabilities for packages: spark-operator, aws-efs-csi-driver-fips, local-static-provisioner, kubeflow-pipelines, kubernetes, nodetaint, argocd-image-updater-fips, rancher-webhook, kubernetes-dns-node-cache, ip-masq-agent, kubernetes-csi-driver-hostpath, aws-ebs-csi-driver, aws-efs-csi-driver,...

CVE-2024-3177 vulnerabilities

Vulnerabilities for packages: spark-operator, aws-efs-csi-driver-fips, local-static-provisioner, kubeflow-pipelines, kubernetes, nodetaint, argocd-image-updater-fips, rancher-webhook, kubernetes-dns-node-cache, ip-masq-agent, kubernetes-csi-driver-hostpath, aws-ebs-csi-driver, aws-efs-csi-driver,...

BIT-ARGO-CD-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

GO-2024-2667 Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2

Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2...

CVE-2024-31990

A flaw was found in Argo CD. The API server does not enforce project sourceNamespaces, which can allow an attacker to use the UI to edit resources which should only be mutable via gitops...

GHSA-2GVW-W6FJ-7M3C vulnerabilities

Vulnerabilities for packages: argo-cd...

GHSA-2GVW-W6FJ-7M3C vulnerabilities

Vulnerabilities for packages: argo-cd, argo-cd-fips...

GHSA-2GVW-W6FJ-7M3C Argo CD's API server does not enforce project sourceNamespaces

Impact I can convince the UI to let me do things with an invalid Application. 1. Admin gives me p, michael, applications, , demo/, allow, where demo can just deploy to the demo namespace 2. Admin gives me AppProject dev which reconciles from ns dev-apps 3. Admin gives me p, michael, applications,...

Argo CD's API server does not enforce project sourceNamespaces

Impact I can convince the UI to let me do things with an invalid Application. 1. Admin gives me p, michael, applications, , demo/, allow, where demo can just deploy to the demo namespace 2. Admin gives me AppProject dev which reconciles from ns dev-apps 3. Admin gives me p, michael, applications,...

CVE-2024-31990

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

CVE-2024-31990 vulnerabilities

Vulnerabilities for packages: argo-cd...

CVE-2024-31990 vulnerabilities

Vulnerabilities for packages: argo-cd, argo-cd-fips...

CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

CVE-2024-31990

CVE-2024-31990 affects Argo CD: the API server did not enforce project sourceNamespaces, enabling UI-edited resources that should be controlled by gitops. Connected sources confirm this issue in Argo CD and link to fixes in version 2.10.7, 2.9.12, and 2.8.16. Remediation is upgrading to one of th...

CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

CVE-2024-31990

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16...

Argo CD 安全漏洞

Argo CD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g. configuration in the Git repository, automatically synchronizing and deploying...

PT-2024-24340 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10.7 Argo CD versions prior to 2.9.12 Argo CD versions prior to 2.8.16 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces...