CVE-2024-28175

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All...

CVE-2024-28175 vulnerabilities

Vulnerabilities for packages: argo-cd, argo-cd-fips...

CVE-2023-50726 vulnerabilities

Vulnerabilities for packages: argo-cd, argo-cd-fips...

CVE-2023-50726

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

Input validation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

CVE-2023-50726 Users with `create` but not `override` privileges can perform local sync in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

CVE-2023-50726

CVE-2023-50726 affects Argo CD’s Local Sync feature, which lets developers override an application's manifests with locally-defined ones. An improper validation bug allows users with create, but not override, privileges to sync local manifests during app creation, bypassing git/Helm/OCI source re...

CVE-2023-50726 Users with `create` but not `override` privileges can perform local sync in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

CVE-2023-50726 Users with `create` but not `override` privileges can perform local sync in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it...

CVE-2024-28175

CVE-2024-28175 – Argo CD XSS vulnerability. Due to improper URL protocol filtering in the application summary component’s link annotations (link.argocd.argoproj.io), an attacker can inject a javascript: link and trigger cross-site scripting with elevated permissions when a victim clicks it. The i...

CVE-2024-28175 Cross-site scripting on application summary component in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All...

CVE-2024-28175 Cross-site scripting on application summary component in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All...

CVE-2024-28175 Cross-site scripting on application summary component in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All...

Argo CD Security Vulnerability

Argo CD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

PT-2024-2562 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.2.0-rc1 through 2.10.2 Argo CD versions 1.2.0-rc1 through 2.9.7 Argo CD versions 1.2.0-rc1 through 2.8.11 Description: The issue is related to improper validation in Argo CD, a declarative, GitOps continuous delivery tool f...

Argo CD Cross-Site Scripting Vulnerability

Argo CD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: nerdctl, sops, gitsign, timestamp-authority, slsa-verifier, zot, caddy, frp, grpc-health-probe, falcoctl, vexctl, melange, ko, skaffold, dex, skopeo, step, minio, k3s, goreleaser, spire-server, step-ca, rook, dgraph, sigstore-scaffolding, cloudflared, aactl,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: falcoctl, slsa-verifier, rekor-fips, caddy-fips, ko, temporal-fips, temporal-ui-server-fips, nerdctl, vault-csi-provider, tkn, kargo, rook, argo-workflows, frp, tekton-chains, minio, vault, policy-controller-fips, gitsign, kube-oidc-proxy, zarf, kots, caddy, fulcio,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: nerdctl, sops, gitsign, timestamp-authority, slsa-verifier, zot, caddy, frp, grpc-health-probe, falcoctl, vexctl, melange, ko, skaffold, dex, skopeo, step, minio, k3s, goreleaser, spire-server, step-ca, rook, dgraph, sigstore-scaffolding, cloudflared, aactl,...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: k3s, falcosidekick-fips, argo-workflows-fips, kube-bench, temporal-server-fips, wavefront-collector-for-kubernetes, kine, spicedb, caddy-fips, amass, kube-bench-fips, argo-workflows, src, trillian, temporal-server, kots, caddy, ferretdb, trillian-fips, step, step-ca...