Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

Summary In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index 0 is...

MAL-2025-18297 Malicious code in deploytool-git-push (npm)

The package deploytool-git-push was found to contain malicious code...

Malicious code in deploytool-git-push (npm)

The package deploytool-git-push was found to contain malicious code...

Information Disclosure

maven-scm-api is vulnerable to information disclosure attacks. If a git push command failed, the password is printed in plaintext to the logs...