1764 matches found
Malicious code in Argоո.Xml (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Argоո (NuGet)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-6104 vulnerabilities
Vulnerabilities for packages: ksops, buildkitd, aactl, spire-server, vexctl, tekton-chains-fips, actions-runner-controller-fips, rekor, cosign, src-fingerprint, loki, vault-csi-provider, flux-kustomize-controller, gitsign, rekor-fips, sops, gh, vault, crossplane-provider-azure-sql, gomplate-fips,...
GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd...
CVE-2024-37152
A flaw was found in Argo-CD. There is an issue with unauthenticated information disclosure of settings data through an exposed API endpoint at /api/v1/settings...
CVE-2024-36106
A flaw was found in Argo-CD. Error messages in Argo-CD may contain sensitive information, such as clusters and project names, which allows authenticated malicious users to enumerate possible targets...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: buildkitd, py3-azure-identity, falcoctl, wal-g, grafana-mimir, trino, goreleaser, cosign, chezmoi, velero, harbor-registry, sqlpad, k8sgpt, rekor, guac, argo-workflows, trivy, rclone, sops, restic, airflow, py3-cassandra-medusa, boring-registry, fulcio, rook,...
Cluster Name Enumeration
github.com/argoproj/argo-cd is vulnerable to Cluster Name Enumeration. This vulnerability is due to inadequate handling of error messages such as cluster names, allowing attackers to enumerate clusters and project names within project-scoped clusters...
Improper Authorization
github.com/argoproj/argo-cd/ is vulnerable to Improper Authorization. The vulnerability is caused by the exposure of the passwordPattern setting through the /api/v1/settings endpoint without authentication...
BIT-ARGO-CD-2024-36106 Argo CD allows authenticated users to enumerate clusters by name
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. Thi...
BIT-ARGO-CD-2024-37152 Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...
Unauthenticated Access to sensitive settings in Argo CD
Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. Details Unauthenticated Access: Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive...
GHSA-87P9-X75H-P4J2 Unauthenticated Access to sensitive settings in Argo CD
Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. Details Unauthenticated Access: Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive...
GHSA-3CQF-953P-H5CP Argo-cd authenticated users can enumerate clusters by name
Impact It’s possible for authenticated users to enumerate clusters by name by inspecting error messages: $ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H "Authorization: Bearer $token" "error":"permission denied: clusters, get, , sub: alice, iat:...
Argo-cd authenticated users can enumerate clusters by name
Impact It’s possible for authenticated users to enumerate clusters by name by inspecting error messages: $ curl -k 'https://localhost:8080/api/v1/clusters/in-cluster?id.type=name' -H "Authorization: Bearer $token" "error":"permission denied: clusters, get, , sub: alice, iat:...
CVE-2024-37152
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...
CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...
CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...
CVE-2024-37152
Argo CD exposes sensitive settings via /api/v1/settings without authentication, enabling unauthenticated access to items such as passwordPattern. The issue is fixed in versions 2.11.3, 2.10.12, and 2.9.17. Affected product: Argo CD (Kubernetes GitOps tool). Root cause described across sources as ...
CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...