CVE-2024-22424 vulnerabilities

Vulnerabilities for packages: argo-cd...

CVE-2024-22424 vulnerabilities

Vulnerabilities for packages: argo-cd...

CVE-2024-22424

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

Cross site request forgery (csrf)

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424

CVE-2024-22424 affects Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 (and related 2.7.16 per some advisories). The root cause is failure to validate that requests carry the correct content type, allowing bypass of browser CORS preflight checks and enabling CSRF via cross-origin...

PT-2024-1295 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 Description: The issue is related to a cross-server request forgery CSRF attack. An attacker can trick an authenticated Argo CD user into loading a web page that contains code to ca...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, zarf, boring-registry, crossplane-provider-aws-firehose, syft, rclone, tekton-chains, pulumi-language-dotnet, apko, flux-notification-controller, zot, pulumi-kubernetes-operator, crossplane-provider-aws-dynamodb,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, task, argo-events-fips, argo-events, snyk-cli, flux-notification-controller, melange...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-workflows, snyk-cli, melange, flux-notification-controller, pulumi-kubernetes-operator, task, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-workflows, snyk-cli, melange, flux-notification-controller, pulumi-kubernetes-operator, task, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, task, argo-events-fips, argo-events, snyk-cli, flux-notification-controller, melange...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, aws-ebs-csi-driver, aws-efs-csi-driver-fips, kubernetes-dns-node-cache, nodetaint, aws-efs-csi-driver, prometheus-adapter, ip-masq-agent, spark-operator...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, aws-ebs-csi-driver, aws-efs-csi-driver-fips, kubernetes-dns-node-cache, nodetaint, aws-efs-csi-driver, prometheus-adapter, ip-masq-agent, spark-operator...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: kubescape, envoy-ratelimit, kubernetes-csi-external-resizer, docker-compose, cri-tools, metrics-server, volume-modifier-for-k8s, k3s, temporal, kubevela, kine, kubernetes, temporal-server, buildkitd...

GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, cluster-autoscaler-fips, aws-efs-csi-driver-fips, kubeflow-pipelines...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines...