BIT-ARGO-WORKFLOWS-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: buf, capslock, flux-image-automation-controller, guac, ferretdb, aws-load-balancer-controller, secrets-store-csi-driver-provider-gcp, step-ca, cilium-cli, certificate-transparency, flux-source-controller, hubble, fuse-overlayfs-snapshotter, pulumi-language-dotnet,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter-fips, up, weaviate, terraform-docs, kaniko, kube-logging-operator, kubernetes-csi-external-provisioner, bank-vaults-fips, nfs-subdir-external-provisioner-fips, aws-load-balancer-controller, local-path-provisioner,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: spicedb, trillian, ferretdb, kube-bench, src, temporal-server, kine, amass, k3s, step-ca, step, kots, argo-workflows, caddy...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows, temporal-server, argo-workflows-fips, step, caddy, src, kots, falcosidekick-fips, k3s, kube-bench, caddy-fips, step-ca, kine, wavefront-collector-for-kubernetes, temporal-server-fips, amass, kube-bench-fips, ferretdb, trillian, spicedb...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows, temporal-server, argo-workflows-fips, step, caddy, src, kots, falcosidekick-fips, k3s, kube-bench, caddy-fips, step-ca, kine, wavefront-collector-for-kubernetes, temporal-server-fips, amass, kube-bench-fips, ferretdb, trillian, spicedb...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows, caddy-fips, step-ca, argo-workflows-fips, step, caddy, trillian, wavefront-collector-for-kubernetes, kots...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: cosign, goreleaser, policy-controller, cri-tools, ko-fips, argo-workflows, kargo, kubevela, slsa-verifier, vexctl, argo-workflows-fips, docker-credential-gcr, gitsign, kubeflow-katib, up, dagger, guac, k3d, flux, flux-image-reflector-controller, helm-operator-fips,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: cosign, goreleaser, policy-controller, cri-tools, ko-fips, argo-workflows, kargo, kubevela, slsa-verifier, vexctl, argo-workflows-fips, docker-credential-gcr, gitsign, kubeflow-katib, up, dagger, guac, k3d, flux, flux-image-reflector-controller, helm-operator-fips,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: snyk-cli, argo-workflows, argo-events, melange, task, flux-notification-controller, argo-events-fips, pulumi-kubernetes-operator...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-events, snyk-cli, flux-notification-controller, melange, pulumi-kubernetes-operator, task, argo-workflows...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, argo-workflows, argo-events, melange, task, flux-notification-controller, argo-events-fips, pulumi-kubernetes-operator...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events, snyk-cli, flux-notification-controller, melange, pulumi-kubernetes-operator, task, argo-workflows...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Privilege Escalation

github.com/argoproj/argo-workflows is vulnerable to privilege escalation. An attacker can create a workflow through the newHTTPServer function of argoserver.go that produces an HTML artifact and makes XRL calls to the Argo Server API by using a script, allowing the attacker to send malicious emai...

CVE-2022-29164

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Hardcoded credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Argo Workflows 安全漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Cloud Native Computing Foundation. A security vulnerability exists in Argo Workflows. An attacker can trick a victim into creating or deleting workflows through deception...