CVE-2022-27479

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue...

PYSEC-2022-188

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue...

Sql injection

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue...

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...

Improper Access Control

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's...

PT-2022-6942 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.3.0 through 2.1.10 Argo CD versions 2.2.0 through 2.2.5 Argo CD versions 2.3.0 and earlier, excluding 2.3.0 itself as it is a fixed version Description: The issue is related to a path traversal bug compounded by an improper...

GitHub argo-cd 访问控制错误漏洞

GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. GitHub argo-cd suffers from an Access Control Error vulnerability that stems from a path traversal flaw in ArgoCD. An attacker could exploit the vulnerability to craft a special...

CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Jenkins global-build-stats Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building and deploying projects. The vulnerability is caused by the plugin's failure to escape multiple fields in the chart configuration...

PT-2022-18294 · Jenkins · Jenkins Global-Build-Stats Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins global-build-stats Plugin versions 1.5 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because multiple fields in the chart configuration on the 'Global Build Stats' page are...

Microsoft SharePoint Chart Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft SharePoint Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of charts. Tampering with client-side data can trigger the...

New Argo CD Bug Could Let Hackers Steal Secret Info from Kubernetes Apps

Users of the Argo continuous deployment CD tool for Kubernetes are being urged to push through updates after a zero-day vulnerability was found that could allow an attacker to extract sensitive information such as passwords and API keys. The flaw, tagged as CVE-2022-24348 CVSS score: 7.7, affects...

The vulnerability of the Chart component in the SolarWinds Patch Manager software allows a hacker to execute arbitrary code by restoring unreliable data in memory.

The vulnerability of the Chart component in the SolarWinds Patch Manager software involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Mike Perham Sidekiq 安全漏洞

Mike Perham sidekiq is an application open sourced by Mike Perham. Using threads to process many jobs simultaneously in the same process, a security vulnerability exists in Mike Perham Sidekiq, which stems from the api.rb of Sidekiq before 6.4.0, where there is no limit on the number of days to...

Exploit for SQL Injection in Artica Pandora_Fms

CVE-2021-32099 CVE-2021-32099 POC : http://localhost:8000/pan...

Design/Logic Flaw

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system...

CVE-2021-23154 Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system...

Lens 操作系统命令注入漏洞

Lens is a distribution of the OpenLens repository that contains Team Lens-specific customizations released under the legacy EULA. An operating system command injection vulnerability exists in versions of Lens prior to 5.3.4 that originates when a customized helm chart configuration creates a helm...

Mermaid 安全漏洞

Mermaid is a software application. Create charts and visualizations using text and code. A security vulnerability exists in versions prior to Mermaid 8.13.8, which can be exploited by an attacker to run javascript code via a malicious chart on the machine reading the chart...

CVE-2020-11013

A flaw was found in helm. The helm template lookup function bypasses the intended security property that the running helm template will not attach to a helm cluster. This flaw allows a malicious template to disclose facts about the cluster without the administrator's consent. Mitigation Three...