Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user. Remediation Upgrade github.com/argoproj/argo-cd/cmd to version 1.7.13, 1.8.6 or higher...

Cybersecurity in Cyberpunk 2077: the good, the bad, and the cringeworthy

What game caused some players to experience seizures, allows you to have unauthorized sex with Keanu Reeves, features a lead character who can’t keep the contents of his pants contained, was pulled from the PlayStation Store weeks after release, and still managed to shatter sales and streaming...

Security Bulletin: IBM MQ Appliance is affected by multiple BIND vulnerabilities (CVE-2020-8622, CVE-2020-8623, CVE-2020-8624)

Summary IBM MQ Appliance has resolved multiple BIND vulnerabilities. Vulnerability Details CVEID: CVE-2020-8622 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure when attempting to verify a truncated response to a TSIG-signed request. By sending a...

Mail.ru: [app-01.youdrive.club] RCE in CI/CD via dependency confusion

Dependency confusion allowed remote code execution in youdrive CI/CD pipeline as was demonstrated by researcher via creation of public npmjs.com package matching internal dependancy. I've extracted and saved the content of package.json file for further research during investigating the previous...

Insecure Session Management

github.com/argoproj/argo-cd handles session tokens in an insecure manner. The issue arises when it does not check if an account is deactivated before returning a valid token claim...

Cyberpunk 2077 Maker Was Hit With Ransomware—and Won't Pay Up

CD Projekt Red's list of woes gets longer, as hackers claim to have stolen the source code for their most popular games...

CD Projekt ransomware attack – Cyberpunk 2077 source code allegedly stolen

By Waqas The Polish video game developer CD Projekt, known for games like Cyberpunk 2077, has fallen victim to a ransomware attack. This is a post from HackRead.com Read the original post: CD Projekt ransomware attack - Cyberpunk 2077 source code allegedly stolen...

Cyberpunk 2077 developer hit by ransomware

CD PROJEKT RED, the game developer behind Cyberpunk 2077, announced earlier on Twitter that it has fallen victim to a targeted ransomware attack. The company says it has backups for the affected systems and does not intend to pay the ransom. In their ransom note the attackers boast that they have...

Cyberpunk 2077 Publisher Hit with Hack, Ransomware

UPDATE CD Projekt Red, the videogame-development company behind Cyberpunk 2077 and the wildly popular Witcher series, has suffered a ransomware attack that could soon result in troves of company data being dumped online – including game source code. The Warsaw-based company tweeted out a notice o...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

Code injection

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled...

CVE-2021-26921

CVE-2021-26921 affects Argo CD before 1.8.4, from the util/session/sessionmanager.go code. The root issue allows tokens to remain valid after the associated user account is disabled, enabling continued token authentication despite deactivation. The impact is described across multiple sources (e.g...

PT-2021-17177 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 1.8.4 Description: The issue arises from the fact that tokens remain active even after the associated user account has been disabled. This is due to a problem in the util/session/sessionmanager.go file...

IBM MQ 7.5 / 8.0 / 9.0 < 9.0.0.11 LTS / 9.1 < 9.1.0.7 LTS / 9.2 < 9.2.0.1 LTS / 9.2 < 9.2.1 CD (6408626)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this...

Design/Logic Flaw

IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 191752...

CVE-2020-4869

IBM MQ Appliance 9.2 CD and 9.2 LTS are affected by CVE-2020-4869, a denial-of-service via buffer overflow triggered by a crafted SNMP query, causing the appliance to reload. IBM remediation for 9.2 LTS is fixpack 9.2.0.1; for 9.2 CD, interim fix IT34178 (iFix) is available. Affected products and...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...