The vulnerability of the web terminal of the declarative delivery tool for GitOps for Kubernetes Argo CD allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the web terminal of the GitOps continuous delivery tool for Kubernetes Argo CD is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ICEcoder vulnerable to Cross Site Scripting

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41692

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this...

CVE-2024-41692: On-Chip Debug and Test Interface With Improper Access Control

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this...

PT-2024-29383 · Icecoder · Icecoder

Name of the Vulnerable Software and Affected Versions: ICEcoder version 8.1 Description: The issue is related to Cross Site Scripting XSS via the lib/terminal-xhr.php file. This allows for potential malicious script execution. No information is provided about the estimated number of affected...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41375

ICEcoder version 8.1 is vulnerable to a Cross-Site Scripting (XSS) flaw located in the lib/terminal-xhr.php file. This vulnerability allows for the potential execution of malicious scripts within the user's browser. While no specific patch version is currently documented, it is recommended to res...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

CVE-2024-41375

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

ICEcoder 安全漏洞

ICEcoder is a browser-based code editor from ICEcoder open source. Allows users to code online or offline directly in a web browser. A security vulnerability exists in ICEcoder version 8.1, which originated from a discovery via lib/terminal-xhr.php that contained a cross-site scripting...

CVE-2024-41375: Improper Neutralization of Input During Web Page Generation

ICEcoder 8.1 is vulnerable to Cross Site Scripting XSS via lib/terminal-xhr.php...

The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

GHSA-V8WX-V5JQ-QHHW The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD v2.11.3 and before, discovering that even if the user's p, role:myrole, exec, create, /, allow permissions are revoked, the user can still send any Websocket message, which allows the user to view sensitive information. Even though they shouldn't have such access. Description Argo CD has ...

CVE-2024-41666

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666

Argo CD's Web-based terminal vulnerability allows a user with permissions p, role:myrole, exec, create, / , allow to continue operations in the container even after revoking that permission, as long as the terminal view stays open. The issue can persist beyond token expiration/revocation and is n...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...