1772 matches found
GHSA-XRQC-7XGX-C9VH RCE via ZipSlip and symbolic links in argoproj/argo-workflows
Summary The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. Details The untar code that handles symbolic links in archives is unsafe. Concretely, the computation of the link's target and the subsequent check are flawed:...
Argo Workflows 操作系统命令注入漏洞
Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. An operating system command injection vulnerability exists in Argo Workflows versions 3.6.13 and earlier and versions 3.7.0 through 3.7.4, which stems from improper handling of symbolic links a...
GHSA-PJ86-CFQH-VQX6 vulnerabilities
Vulnerabilities for packages: sqlpad, saf, thingsboard, argo-workflows, json-server, tileserver-gl...
CVE-2024-51999 vulnerabilities
Vulnerabilities for packages: sqlpad, saf, thingsboard, argo-workflows, json-server, tileserver-gl...
CVE-2024-51999 vulnerabilities
Vulnerabilities for packages: sqlpad, argo-workflows, saf, redisinsight, thingsboard, librechat, tileserver-gl, json-server...
GHSA-PJ86-CFQH-VQX6 vulnerabilities
Vulnerabilities for packages: sqlpad, argo-workflows, saf, redisinsight, thingsboard, librechat, tileserver-gl, json-server...
Information Disclosure
github.com/argoproj/argo-workflows is vulnerable to Information Disclosure. The vulnerability is due to artifact repository credentials being logged in plaintext within the workflow-controller pod logs, which allows an attacker with permission to read pod logs to obtain these credentials and...
Directory Traversal
github.com/argoproj/argo-workflows is vulnerable to Directory Traversal. The vulnerability is due to improper validation of archive entry paths during artifact extraction, which allows an attacker to craft malicious archive files that write arbitrary files outside the intended extraction director...
Denial-of-service (DoS)
github.com/argoproj/argo-cd is vulnerable to a Denial-of-service DoS. The vulnerability is due to Argo CD’s /api/webhook endpoint crashing when it receives a malformed Gogs push event with a missing or null commits.repo field, which allows an attacker to send crafted API requests that crash the A...
Denial-of-service (DoS)
github.com/argoproj/argo-cd is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of malformed Bitbucket Server webhook payloads—specifically a non-array repository.links.clone field—which allows an attacker to send a single unauthenticated malicious request that...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, argo-events, splunk-otel-collector, jitsucom-bulker, bento, cluster-api-aws-controller, grafana-alloy...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, argo-events, splunk-otel-collector, jitsucom-bulker, bento, cluster-api-aws-controller, grafana-alloy...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-fips, argo-events, amazon-cloudwatch-agent, telegraf, cluster-api-aws-controller, vault-fips, splunk-otel-collector, bento, cluster-api-aws-controller-fips, grafana-alloy, sqlexporter, splunk-otel-collector-fips, argo-events-fips,...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-fips, argo-events, amazon-cloudwatch-agent, telegraf, cluster-api-aws-controller, vault-fips, splunk-otel-collector, bento, cluster-api-aws-controller-fips, grafana-alloy, sqlexporter, splunk-otel-collector-fips, argo-events-fips,...
VulnCheck KEV: CVE-2025-55190
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwor...
The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to insufficient protection of operational data, allows attackers to disclose protected information.
The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD lies in the insufficient protection of sensitive data at the final endpoint /api/v1/projects/project/detailed. Exploiting this vulnerability could allow a malicious actor to disclose protected information...
SUSE CVE-2025-62156
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic...
SUSE CVE-2025-62157
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissio...