CVE-2022-41354

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications...

PT-2023-21860 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 23.1.0 Description: The issue is a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An...

CVE-2022-41354

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications...

Internet Bug Bounty: Authenticated but unauthorized users may enumerate Application names via the API

An information disclosure vulnerability existed in all versions of Argo CD starting with v0.5.0, allowing authenticated but unauthorized users to enumerate application names via API error messages. This could be used as a starting point for further attacks, such as social engineering. The...

Information Disclosure

github.com/argoproj/argo-cd is vulnerable to Information Disclosure. The vulnerability is due to a bug that allows unauthorized users to enumerate application names by inspecting API error messages, which can then be used as a starting point for another attack...

Argo CD authenticated but unauthorized users may enumerate Application names via the API

Impact All versions of Argo CD starting with v0.5.0 are vulnerable to an information disclosure bug allowing unauthorized users to enumerate application names by inspecting API error messages. An attacker could use the discovered application names as the starting point of another attack. For...

GHSA-2Q5C-QW9C-FMVQ Argo CD authenticated but unauthorized users may enumerate Application names via the API

Impact All versions of Argo CD starting with v0.5.0 are vulnerable to an information disclosure bug allowing unauthorized users to enumerate application names by inspecting API error messages. An attacker could use the discovered application names as the starting point of another attack. For...

CVE-2022-41354

An information disclosure flaw was found in Argo CD. This issue may allow unauthorized users to enumerate application names by inspecting API error messages and could use the discovered application names as the starting point of another attack. For example, the attacker might use their knowledge ...

Argo CD 安全漏洞

Argo is an open source container native workflow engine. A security vulnerability exists in Argo CD version 2.4.12 and earlier. An attacker exploited the vulnerability to enumerate application names...

PT-2023-13975 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 0.5.0 through 2.4.12 Argo CD versions 2.5.0 through 2.5.15 Argo CD versions 2.6.0 through 2.6.6 Description: An access control issue in Argo CD allows unauthorized users to enumerate existing applications by inspecting API...

[SECURITY] Fedora 38 Update: qmmp-2.1.2-4.fc38

This program is an audio-player, written with help of Qt library. The user interface is similar to winamp or xmms. Main opportunities: Winamp and xmms skins support plugins support MPEG1 layer 2/3 support Ogg Vorbis support native FLAC support WavePack support ModPlug support PCM WAVE support CD...

[SECURITY] Fedora 38 Update: k3b-22.12.3-2.fc38

K3b provides a comfortable user interface to perform most CD/DVD burning tasks. While the experienced user can take influence in all steps of the burning process the beginner may find comfort in the automatic settings and the reasonable k3b defaults which allow a quick start...

Fedora: Security Advisory for blender (FEDORA-2023-a5e10b188a)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

github-slug-action vulnerable to arbitrary code execution

Impact This action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. Note that...

EulerOS 2.0 SP5 : colord (EulerOS-SA-2023-1492)

According to the versions of the colord packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to CVE-2022-41717 in Go

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to CVE-2022-41717 in Go with details below. Vulnerability Details CVEID:CVE-2022-41717 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in th...

Internet Bug Bounty: JWT audience claim is not verified

An improper authorization vulnerability existed in all versions of Argo CD starting with v1.8.2, allowing the API to accept certain invalid tokens due to the lack of validation of the audience claim in signed tokens. This could allow an attacker to use a stolen token intended for a different...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in the authentication process, allows attackers to increase their privileges.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges...

K72453266: Linux kernel vulnerability CVE-2013-2164

Security Advisory Description The mmcioctlcdromreaddata function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive. CVE-2013-2164 Impact There is no impact; F5...

[SECURITY] Fedora 37 Update: ImageMagick-6.9.12.77-1.fc37

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...