The vulnerability of the web terminal of the declarative delivery tool for GitOps for Kubernetes Argo CD allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the web terminal of the GitOps continuous delivery tool for Kubernetes Argo CD is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ICEcoder vulnerable to Cross Site Scripting

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41692

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this...

ICEcoder 安全漏洞

ICEcoder is a browser-based code editor from ICEcoder open source. Allows users to code online or offline directly in a web browser. A security vulnerability exists in ICEcoder version 8.1, which originated from a discovery via lib/terminal-xhr.php that contained a cross-site scripting...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

PT-2024-29383 · Icecoder · Icecoder

Name of the Vulnerable Software and Affected Versions: ICEcoder version 8.1 Description: The issue is related to Cross Site Scripting XSS via the lib/terminal-xhr.php file. This allows for potential malicious script execution. No information is provided about the estimated number of affected...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41375

CVE-2024-41375 affects ICEcoder 8.1, with a Cross Site Scripting (XSS) vulnerability via lib/terminal-xhr.php. Affected component: lib/terminal-xhr.php in ICEcoder 8.1. Documented impact: XSS; no exploit specifics or fixed version are provided in the supplied sources. Remediation status not state...

The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

GHSA-V8WX-V5JQ-QHHW The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

CVE-2024-41666

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666

Argo CD's Web-based terminal vulnerability allows a user with permissions p, role:myrole, exec, create, / , allow to continue operations in the container even after revoking that permission, as long as the terminal view stays open. The issue can persist beyond token expiration/revocation and is n...

Argo CD 安全漏洞

Argo CD is a declarative GitOps continuous delivery tool for Kubernetes open-sourced by the Argo Project. A security vulnerability exists in Argo CD versions 2.6.0 through 2.11.3, which stems from a web terminal that allows a user to obtain a shell inside a running Pod. When an administrator...

Magento Sites Targeted with Sneaky Credit Card Skimmer via Swap Files

Threat actors have been observed using swap files in compromised websites to conceal a persistent credit card skimmer and harvest payment information. The sneaky technique, observed by Sucuri on a Magento e-commerce site's checkout page, allowed the malware to survive multiple cleanup attempts, t...

CLSA-2024-1721660263 Fix of 96 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-35902 - net/rds: fix possible cp null dereference CVE-url: https://ubuntu.com/security/CVE-2024-38587 - speakup: Fix sizeof vs ARRAYSIZE bug CVE-url: https://ubuntu.com/security/CVE-2024-39493 - crypto: qat - Fix ADFDEVRESETSYNC memory leak CVE-url:...

CLSA-2024-1721659604 Fix of 96 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-35902 - net/rds: fix possible cp null dereference CVE-url: https://ubuntu.com/security/CVE-2024-38587 - speakup: Fix sizeof vs ARRAYSIZE bug CVE-url: https://ubuntu.com/security/CVE-2024-39493 - crypto: qat - Fix ADFDEVRESETSYNC memory leak CVE-url:...