ThoughtWorks GoCD 路径遍历漏洞

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A path traversal vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which could be exploited by an attacker compromising the GoCD agent to upload malicious files to any directory on the GoCD serve...

CVE-2022-22355

IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial-of-service in the Login component, which can degrade performance. IBM’s bulletin IT40182 provides fixes: 9.2 CD—interim firmware 9.2.5-IBM-MQ-Appliance-IT40182; 9.2 LTS—interim firmware 9.2.0.5-IBM-MQ-Appliance-IT40182. No workarounds...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

Design/Logic Flaw

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

Removed by vendor...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

CVE-2022-1120 affects GitLab CE/EE; missing filtering in an error message allows exposure of sensitive information when an include directive in CI/CD configuration fails. Affected versions: all before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. The available connected documents reiterate ...

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to access control deficiencies, allows a perpetrator to increase their privileges.

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2022-1120: Generation of Error Message Containing Sensitive Information

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-25017

Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field...

Hitron Technologies CHITA Router Firmware 操作系统命令注入漏洞

Hitron Technologies CHITA Router Firmware is a router firmware from Hitron Technologies of China. A security vulnerability exists in the Hitron CHITA 7.2.2.0.3b6-CD firmware version that originates from a command injection in the Device/DDNS ddnsUsername field...

Path Traversal

github.com/argoproj/argo-cd is vulnerable to path traversal. A remote attacker is able to craft an API request to the /api/v1/repositories/repourl/appdetails endpoint to leak the contents from the out-of-bounds files in the repo-server...

Information Disclosure

github.com/argoproj/argo-cd is vulnerable to information disclosure. The vulnerability exists in application resource APIs because the access controls are not properly handled which allows an attacker to escalate their privileges to admin-level and access the sensitive information...

GHSA-2F5V-8R3F-8PWW Improper access control allows admin privilege escalation in Argo CD

Impact Impacts for versions starting with v1.0.0 All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. To perform the following exploits, an authorized Argo CD use...

Improper access control allows admin privilege escalation in Argo CD

Impact Impacts for versions starting with v1.0.0 All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. To perform the following exploits, an authorized Argo CD use...

GHSA-H6H5-6FMQ-RH28 Path traversal allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted create or update access to Applications...

Path traversal allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted create or update access to Applications...

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...