2325 matches found
PT-2021-17179 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: An issue was discovered where browser XSS protection is not activated due to the missing XSS protection header. Recommendations: For versions prior to 1.8.4, update to version 1.8.4 or later to...
PT-2021-17178 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: An issue in Argo CD allows accessing the "api/version" endpoint, which leaks internal system information. This endpoint is not protected with authentication. Recommendations: For versions prior to...
CVE-2021-26923: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication...
Argo 跨站脚本漏洞
Argo is an open source container-native workflow engine. A security vulnerability exists in Argo that stems from a missing cross-site protection header that results in the browser's cross-site protection not being activated...
CVE-2021-26924: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header...
Argo 信息泄露漏洞
Argo is an open source container native workflow engine. An information disclosure vulnerability exists in Argo CD versions prior to 1.8.4, which stems from the fact that accessing the endpoint api version discloses internal information about the system and the endpoint is not protected by...
Cross-site Scripting (XSS)
github.com/argoproj/argo-cd is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via a malicious error message...
CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
CVE-2021-23347 Cross-site Scripting (XSS)
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
CVE-2021-23347
CVE-2021-23347 affects the Argo CD project, specifically the command line interface in the package github.com/argoproj/argo-cd/cmd before 1.7.13, and in 1.8.0 up to before 1.8.6. The underlying issue is a Cross-site Scripting (XSS) vulnerability triggered when the SSO provider returns a malicious...
CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
PT-2021-15451 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: argo-cd versions prior to 1.7.13 argo-cd versions 1.8.0 through 1.8.6 Description: The issue is related to Cross-site Scripting XSS where a malicious SSO provider connected to Argo CD could send back a malicious error message containing...
CVE-2021-23347: Improper Neutralization of Input During Web Page Generation
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
argo-cd 跨站脚本漏洞
GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. github.com/argoproj/argo-cd/cmd A cross-site scripting vulnerability exists, which stems from the fact that SSO providers connecting to Argo CD will have to send malicious error...
Argo Code Issues Vulnerabilities
Argo is an open source container native workflow engine. A code issue vulnerability exists in Argo CD versions prior to 1.8.4, which stems from the incorrect handling of Token in the util/session/sessionmanager.go file, resulting in the Token remaining valid after the user is unavailable. No...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user. Remediation Upgrade github.com/argoproj/argo-cd/cmd to version 1.7.13, 1.8.6 or higher...
Insecure Session Management
github.com/argoproj/argo-cd handles session tokens in an insecure manner. The issue arises when it does not check if an account is deactivated before returning a valid token claim...
