Directory traversal

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

CVE-2024-25620 Dependency management path traversal in helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

CVE-2024-25620

CVE-2024-25620 – Helm path traversal vulnerability : The connected Nessus entry confirms a concrete issue in Helm where saving a chart with a relative path in Chart.yaml can cause the chart to be saved outside its intended directory. This is due to improper validation of user-supplied input, enab...

CVE-2024-25620 Dependency management path traversal in helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

sidekiq: DoS in dashboard-charts

A denial of service vulnerability was found in Sidekiq. This flaw allows an attacker to manipulate the localStorage value in the dashboard-charts.js file and cause excessive polling requests...

CVE-2023-52191

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Torbjon Infogram – Add charts, maps and infographics allows Stored XSS.This issue affects Infogram – Add charts, maps and infographics: from n/a through 1.6.1...

Stored Cross Site Scripting (XSS)

apachesuperset is vulnerable to Stored Cross Site Scripting XSS. An authenticated attacker with create or update permissions on charts or dashboards could store a malicious script or add a specific HTML snippet, resulting in Stored Cross Site Scripting XSS...

GHSA-G49J-J489-3XPF Apache Superset incorrect write permissions vulnerability

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2...

Apache Superset incorrect write permissions vulnerability

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2...

CVE-2023-49734

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2...

CVE-2023-49860

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project...

CVE-2023-49860 WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project...

CVE-2023-49860 WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project...

CVE-2023-47662

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin = 2.4 versions...

CVE-2023-47662

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin = 2.4 versions...

CVE-2023-40026

A flaw was found in Argo CD. For any version using Helm, using a specially crafted Helm file could reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart. This issue is possible because the Helm paths were predictable. Mitigation...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

ArgoCD Path Traversal Vulnerability

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

PT-2023-27220 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.3 Description: Argo CD is a declarative continuous deployment framework for Kubernetes. The issue allows an attacker to reference external Helm charts handled by the same repo-server to leak values or files from th...