Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be use...

Malicious code in slack_beacon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec265d6998a8c575db6e6f9733bab85971cd9e73c81b377bf4bf561ee839499b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 445636484e7e1f64d9f0aa02fac99151c327835b8acc2aea369afdc8629f9535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6157 Malicious code in slack-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 445636484e7e1f64d9f0aa02fac99151c327835b8acc2aea369afdc8629f9535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-reacjilator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 572174fdb15c6f7bdad8a6077af3f009598cebd777cbaa198f3437dbfc2019a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6160 Malicious code in slack-reacjilator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 572174fdb15c6f7bdad8a6077af3f009598cebd777cbaa198f3437dbfc2019a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monday-integration-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1101e9f2bfaedb93d309fca08d582a85f84067e01343b07e8f2186b4214f43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in curri-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00fcf2aed2ef83f63aa909e95ceaeba67a19ae3189fe65bda5debdb8856e229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2276 Malicious code in curri-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00fcf2aed2ef83f63aa909e95ceaeba67a19ae3189fe65bda5debdb8856e229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bfx-facs-grc-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d68b2d23fdbc513af252da8c8fe29ba0d5899a93e9142ae773ba68ff7b60190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6159 Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9520877ee689f4ae7ba25d861168d154264a54e831d5496ceb94a7e46fa8a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3594 Malicious code in helix-slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9520877ee689f4ae7ba25d861168d154264a54e831d5496ceb94a7e46fa8a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ee93f4c06b6c956c91b01c4f2d5eb9786fb5d5e54a6673f8ea80a21d38a7ae2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6158 Malicious code in slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ee93f4c06b6c956c91b01c4f2d5eb9786fb5d5e54a6673f8ea80a21d38a7ae2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-W3VW-CCC5-QR8V Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

Insecure path traversal in Git Trigger Source can lead to arbitrary file read

Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...