3340 matches found
CVE-2022-24730
Summary of CVE-2022-24730 (Argo CD) : A path traversal combined with improper access control affects Argo CD versions before 2.1.11, 2.2.6, and 2.3.0. A user with read-only repository access and appropriate repository grant (e.g., get on a repo containing a Helm chart) can craft a request to /api...
CVE-2022-24730 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...
CVE-2022-22316
CVE-2022-22316 relates to IBM MQ Appliance where an authenticated user could cause a denial of service due to incorrectly configured authorization checks on the IBM MQ appliance’s clustering/authorization logic. The primary affected delivery is IBM MQ Appliance 9.2 CD and 9.2 LTS. IBM’s bulletin ...
Amazing CD Ripper 1.2 Buffer Overflow Exploit
Exploit Title: Amazing CD Ripper v1.2 - Buffer Overflow Exploit Author: Hejap Zairy Software Link: http://www.shelltoys.com/cdripper.exe Software Link: https://web.archive.org/web/20160313071152/http://www.shelltoys.com/cdripper.exe Tested Version: v1.2.1 Tested on: Windows 10 64bit 1.- Run pytho...
CVE-2022-24730: Improper Limitation of a Pathname to a Restricted Directory
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...
CVE-2022-24731: Improper Limitation of a Pathname to a Restricted Directory
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's...
PT-2022-16865 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions 0.5.0 through 2.3.1 Argo CD versions 2.0.x and earlier Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper...
CVE-2022-24768: Exposure of Sensitive Information to an Unauthorized Actor
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5...
GitHub argo-cd 访问控制错误漏洞
GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. GitHub argo-cd suffers from an Access Control Error vulnerability that stems from a path traversal flaw in ArgoCD. An attacker could exploit the vulnerability to craft a special...
Amazing CD Ripper 1.2 Buffer Overflow
Exploit Title: Amazing CD Ripper v1.2 - Buffer Overflow Exploit Author: Hejap Zairy Date: 03.08.2022 Software Link: http://www.shelltoys.com/cdripper.exe Software Link: https://web.archive.org/web/20160313071152/http://www.shelltoys.com/cdripper.exe Tested Version: v1.2.1 Tested on: Windows 10...
GHSA-VQ6C-FVXW-P45V CSRF vulnerability in Jenkins kubernetes-cd Plugin allow capturing credentials
A cross-site request forgery CSRF vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
Missing permission checks in Jenkins kubernetes-cd Plugin allow enumerating credentials IDs
kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
Moderate: Red Hat Security Advisory: libarchive security update
An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
ALSA-2022:0892 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
CSRF vulnerability and missing permission checks in kubernetes-cd allow capturing credentials
kubernetes-cd 2.3.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...
Missing permission checks in kubernetes-cd allow enumerating credentials IDs
kubernetes-cd 2.3.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
MIcrosoft Windows CD-ROM Driver Elevation of Privilege Vulnerability
Microsoft Windows is a CD-ROM driver from Microsoft Corporation, and an elevation of privilege vulnerability exists in the Microsoft Windows CD-ROM Driver, which could be exploited by attackers to execute arbitrary code with elevated privileges...
CVE-2022-24455
Windows CD-ROM Driver Elevation of Privilege Vulnerability...
