CVE-2018-21034

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git...

Code injection

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git...

CVE-2018-21034

CVE-2018-21034 affects Argo CD (and Argo) where authenticated users can submit API calls to retrieve secrets and other manifests stored in git. Root cause: insufficient access control enabling information disclosure via API requests. Impact: exposure of secrets and manifests stored in git. Affect...

CVE-2018-21034

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git...

CVE-2019-1003010

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record...

CVE-2019-1387

A flaw was discovered where git improperly validates submodules' names used to construct git metadata paths and does not prevent them from being nested in existing directories used to store another submodule's metadata. A remote attacker could abuse this flaw to trick a victim user into cloning a...

PT-2020-8679 · Argo · Argo

Name of the Vulnerable Software and Affected Versions: Argo versions prior to v1.5.0-rc1 Description: The issue allows authenticated Argo users to submit API calls to retrieve secrets and other manifests stored within git. Recommendations: For versions prior to v1.5.0-rc1, update to version...

Remote Code Execution (RCE)

git-add-remote is vulnerable to Remote Code Execution RCE. The name argument was not escaped to avoid injection of malicious command by the attackers...

OS Command Injection

get-git-data is vulnerable to OS command injection. The vulnerability exists as the values of cmd is not sanitized...

Code Injection in keymetrics/vizion

Overview The issue is an RCE triggerable via the module. This is possible because in the https://github.com/keymetrics/vizion/blob/master/lib/git/git.jsL228 line, the git reset --hard command is concatenated with a unsanitized input: js var command = cliCommandargs.folder, "git reset --hard " +...

git-add-remote command injection vulnerability

git-add-remote is a package for adding Git remote repositories. An injection vulnerability exists in git-add-remote 1.0.0 and earlier versions, which stems from a lack of proper validation of user input. A remote attacker can exploit this vulnerability by sending a specially crafted 'name'...

get-git-data injection vulnerability

get-git-data is a package for accessing Git version information. An injection vulnerability exists in get-git-data 1.3.1 and earlier versions, which stems from a lack of proper validation of user input data. A remote attacker can exploit this vulnerability by sending specially crafted parameters ...

CVE-2020-7630

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...

CVE-2020-7630

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...

CVE-2020-7630

The CVE-2020-7630 entry concerns git-add-remote up to version 1.0.0 with a command-injection flaw: an attacker can execute arbitrary commands via the name argument. The connected sources corroborate the RCE potential but provide no remediation or patch details in the supplied documents.

CVE-2020-7630

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...

CVE-2020-7619

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...

CVE-2020-7619

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...

CVE-2020-7619

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...

CVE-2020-7619

CVE-2020-7619 affects the Node.js package get-git-data up to version 1.3.1. The issue is a Command Injection vulnerability: user-supplied arguments to get-git-data can lead to arbitrary command execution. Multiple connected sources confirm the vulnerability and link it to the lack of input valida...