PT-2022-4593 · Weave · Weave Gitops Enterprise

Name of the Vulnerable Software and Affected Versions: Weave GitOps Enterprise versions prior to 0.9.0-rc.5 Description: The issue is related to a lack of input data sanitization, which can be exploited by a remote attacker to conduct a cross-site scripting XSS attack using a specially crafted...

Weave GitOps 跨站脚本漏洞

Weave GitOps is a simple open source developer platform open sourced by Weaveworks. A security vulnerability exists in Weave GitOps Enterprise prior to version 0.9.0-rc.5, which stems from having cross-site scripting XSS that allows a malicious user to inject a javascript link into the UI, which...

CVE-2022-35976

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

Code injection

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

CVE-2022-35976 Improper KubeConfig handling allows arbitrary code execution

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

CVE-2022-35976

The CVE concerns the GitOps Tools Extension for VSCode, which uses kubeconfigs to talk to Kubernetes clusters. A specially crafted kubeconfig can cause arbitrary code execution under the user running VSCode. Affected users are those with kubeconfigs generated or altered by other processes/users; ...

CVE-2022-35976 Improper KubeConfig handling allows arbitrary code execution

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

CVE-2022-35976 Improper KubeConfig handling allows arbitrary code execution

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

CVE-2022-35975

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

Remote code execution

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

CVE-2022-35975 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

CVE-2022-35975

CVE-2022-35975 affects the GitOps Tools Extension for VSCode. A specially crafted Flux object can cause remote code execution on the machine running VSCode in the context of the user, impacting users managing clusters shared among multiple users. The issue is described as improper object validati...

CVE-2022-35975 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

CVE-2022-35975 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

Microsoft VSCode Extension 操作系统命令注入漏洞

Microsoft VSCode Extension is an extension for VSCode from Microsoft Corporation USA. An operating system command injection vulnerability exists in Microsoft VSCode Extension vscode-gitops-tools versions 0.7.0 through 0.20.2, which originates from a specially crafted Flux object in the context of...

PT-2022-23075 · Microsoft · Vscode

Name of the Vulnerable Software and Affected Versions: GitOps Tools Extension for VSCode affected versions not specified Description: The GitOps Tools Extension for VSCode is affected by an issue where a specially crafted kubeconfig can lead to arbitrary code execution on behalf of the user runni...

PT-2022-23074 · Unknown · Gitops Tools Extension For Vscode

Name of the Vulnerable Software and Affected Versions: GitOps Tools Extension for VSCode affected versions not specified Description: A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users...

CVE-2022-35976: Improper Neutralization of Special Elements used in an OS Command

The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generated or altered by other processes or use...

CVE-2022-35975: Improper Neutralization of Special Elements used in an OS Command

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

CVE-2022-31102

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This...