Lucene search
+L

1755 matches found

GitLab Advisory Database
GitLab Advisory Database
added 2021/08/23 12:00 a.m.19 views

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`

Impact This is pro-active fix. No know exploits exist. Impacted: You're running Kubernetes = v1.19 You're running Argo Server It is configured to with --auth-mode=client Is not configured with --auth-mode=server You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM...

1.6AI score
SaveExploits0References2Affected Software1
GitLab Advisory Database
GitLab Advisory Database
added 2021/08/09 12:00 a.m.54 views

Improper Input Validation

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

6.5CVSS4.9AI score0.00963EPSS
SaveExploits1References7Affected Software1
NVD
NVD
added 2021/08/03 12:15 a.m.27 views

CVE-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

6.5CVSS0.00963EPSS
SaveExploits1References2
OSV
OSV
added 2021/08/03 12:15 a.m.16 views

CVE-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

6.5CVSS6.6AI score
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2021/08/03 12:15 a.m.6 views

CVE-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

6.5CVSS5.9AI score0.00963EPSS
SaveExploits1References3
Prion
Prion
added 2021/08/03 12:15 a.m.12 views

Code injection

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

5.8CVSS6.3AI score0.00963EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2021/08/02 11:17 p.m.78 views

CVE-2021-37914

CVE-2021-37914 affects Argo Workflows (through 3.1.3). When EXPRESSION_TEMPLATES is enabled and untrusted users can specify input parameters for runs, an attacker can disrupt a workflow because expression template output is evaluated. The issue is tied to how template expressions are processed, e...

6.5CVSS6.2AI score0.00963EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2021/08/02 11:17 p.m.31 views

CVE-2021-37914

In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...

6.5AI score0.00963EPSS
SaveExploits1References2
Github Security Blog
Github Security Blog
added 2021/08/02 5:19 p.m.96 views

Attack on Kubernetes via Misconfigured Argo Workflows

Impact Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. Resolution Do not expose your user interface to the Internet. Change...

5.1AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2021/08/02 5:19 p.m.14 views

GHSA-RC7P-GMVH-XFX2 Attack on Kubernetes via Misconfigured Argo Workflows

Impact Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. Resolution Do not expose your user interface to the Internet. Change...

8.1AI score
SaveExploits0References2
GitLab Advisory Database
GitLab Advisory Database
added 2021/08/02 12:00 a.m.22 views

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in github.com/argoproj/argo-workflows...

3.8AI score
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 2021/08/02 12:00 a.m.7 views

PT-2021-21906

Name of the Vulnerable Software and Affected Versions: Argo Workflows versions 3.1.3 and earlier Description: The issue arises when EXPRESSION TEMPLATES is enabled and untrusted users can specify input parameters for workflows. This allows an attacker to potentially disrupt a workflow because the...

6.5CVSS6.4AI score0.00963EPSS
SaveExploits1References13
CNNVD
CNNVD
added 2021/08/02 12:00 a.m.9 views

Argo 输入验证错误漏洞

Argo is an open source container-native workflow engine. A security vulnerability exists in Argo Workflows 3.1.3 that could allow an attacker to corrupt a workflow if EXPRESSIONTEMPLATES is enabled and an untrusted user is allowed to specify input parameters when running the workflow...

6.5CVSS6.5AI score0.00963EPSS
SaveExploits1References3
OSV
OSV
added 2021/07/26 9:19 p.m.36 views

GHSA-XCQR-9H24-VRGW Improper Restriction of Excessive Authentication Attempts in Argo API

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence. Specific Go Packages Affected...

7.5CVSS7.6AI score0.02157EPSS
SaveExploits1References8
Github Security Blog
Github Security Blog
added 2021/07/26 9:19 p.m.82 views

Improper Restriction of Excessive Authentication Attempts in Argo API

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence. Specific Go Packages Affected...

7.5CVSS7.5AI score0.02157EPSS
SaveExploits1References9Affected Software1
Github Security Blog
Github Security Blog
added 2021/07/26 9:19 p.m.101 views

Argo CD Insecure default administrative password

In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names...

8.8CVSS8.4AI score0.018EPSS
SaveExploits1References7Affected Software1
OSV
OSV
added 2021/07/26 9:19 p.m.73 views

GHSA-H8JC-JMRF-9H8F Argo CD Insecure default administrative password

In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names...

8.8CVSS8.6AI score0.018EPSS
SaveExploits1References7
GitLab Advisory Database
GitLab Advisory Database
added 2021/07/26 12:00 a.m.40 views

Improper Restriction of Excessive Authentication Attempts

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...

7.5CVSS4AI score0.02157EPSS
SaveExploits1References9Affected Software1
ThreatPost
ThreatPost
added 2021/07/21 3:19 p.m.76 views

Kubernetes Cloud Clusters Face Cyberattacks via Argo Workflows

Kubernetes clusters are being attacked via misconfigured Argo Workflows instances, security researchers are warning. Argo Workflows is an open-source, container-native workflow engine for orchestrating parallel jobs on Kubernetes – to speed up processing time for compute-intensive jobs like machi...

7.1AI score
SaveExploits0References7
ThreatPost
ThreatPost
added 2021/06/10 4:26 p.m.61 views

Microsoft: Big Cryptomining Attacks Hit Kubeflow

Microsoft has spotted a new, widespread, ongoing attack targeting Kubernetes clusters running Kubeflow instances, in order to plant malicious TensorFlow pods that are used to mine for cryptocurrency. The Kubeflow open-source project is a popular framework for running machine learning ML tasks in...

8AI score
SaveExploits0References10
Rows per page
Query Builder