GHSA-Q559-8M2M-G699 Change in port should be considered a change in origin

Impact Authorization and Cookie headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers from the request, before containing. Previously, we...

Change in port should be considered a change in origin

Impact Authorization and Cookie headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers from the request, before containing. Previously, we...

Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be use...

Malicious code in slack_beacon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec265d6998a8c575db6e6f9733bab85971cd9e73c81b377bf4bf561ee839499b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 445636484e7e1f64d9f0aa02fac99151c327835b8acc2aea369afdc8629f9535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6157 Malicious code in slack-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 445636484e7e1f64d9f0aa02fac99151c327835b8acc2aea369afdc8629f9535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6160 Malicious code in slack-reacjilator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 572174fdb15c6f7bdad8a6077af3f009598cebd777cbaa198f3437dbfc2019a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-reacjilator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 572174fdb15c6f7bdad8a6077af3f009598cebd777cbaa198f3437dbfc2019a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monday-integration-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1101e9f2bfaedb93d309fca08d582a85f84067e01343b07e8f2186b4214f43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2276 Malicious code in curri-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00fcf2aed2ef83f63aa909e95ceaeba67a19ae3189fe65bda5debdb8856e229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in curri-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00fcf2aed2ef83f63aa909e95ceaeba67a19ae3189fe65bda5debdb8856e229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bfx-facs-grc-slack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d68b2d23fdbc513af252da8c8fe29ba0d5899a93e9142ae773ba68ff7b60190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6159 Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3594 Malicious code in helix-slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9520877ee689f4ae7ba25d861168d154264a54e831d5496ceb94a7e46fa8a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9520877ee689f4ae7ba25d861168d154264a54e831d5496ceb94a7e46fa8a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ee93f4c06b6c956c91b01c4f2d5eb9786fb5d5e54a6673f8ea80a21d38a7ae2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6158 Malicious code in slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ee93f4c06b6c956c91b01c4f2d5eb9786fb5d5e54a6673f8ea80a21d38a7ae2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...