CVE-2023-40025

CVE-2023-40025 affects Argo CD where open web terminal sessions do not expire, allowing WebSocket messages after token expiry and potential viewing of sensitive information. Technical details across connected documents confirm the issue is tied to the web terminal feature, with remediation delive...

CVE-2023-40025 Argo CD web terminal session doesn't expire

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most...

GHSA-C8XW-VJGF-94HR Argo CD web terminal session doesn't expire

Impact All versions of Argo CD starting from v2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open fo...

Argo CD web terminal session doesn't expire

Impact All versions of Argo CD starting from v2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open fo...

PT-2023-27219 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0 through 2.6.13 Argo CD versions 2.7.0 through 2.7.11 Argo CD versions 2.8.0 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The issue arises from open web terminal sessions not...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

Schneider Electric EcoStruxure Operator Terminal Expert VXDZ File Parsing Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Operator Terminal Expert. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specif...

CVE-2023-40216

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

CVE-2023-40216

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

CVE-2023-40216

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

Out-of-bounds

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

CVE-2023-40216

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

PT-2023-27333 · Openbsd · Openbsd

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 7.3 before errata 014 Description: The issue is related to a missing argument-count bounds check in console terminal emulation, which could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI...

CVE-2023-40216

CVE-2023-40216 concerns OpenBSD 7.3 before errata 014, where the console terminal emulation (wscons) lacks an argument-count bounds check. This may permit out-of-bounds memory access and could trigger a kernel crash when processing crafted DCS or CSI terminal escape sequences. The issue is docume...

CVE-2023-40216

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences...

Dangerzone Security Breach

Dangerzone is a software application. There are potentially dangerous PDF files, office documents, pictures and convert them into a secure PDF. Dangerzone 0.4.2 prior to the version of a security vulnerability, the vulnerability stems from the dangerzone-cli command to file cleanup container outp...

PT-2023-26889 · Unknown · Dangerzone

Name of the Vulnerable Software and Affected Versions: Dangerzone versions prior to 0.4.2 Description: The issue affects the Dangerzone CLI, where output from the container is logged to the user's terminal. If the container is compromised, an attacker may spoof messages in the terminal or change...

`tui` is unmaintained; use `ratatui` instead

The tui crate is no longer maintained. Consider using the ratatui crate instead...

Server-Side Request Forgery (SSRF)

gitlab is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists in web terminal advertiseaddress which allows an attacker to connect to local addresses when configuring a malicious GitLab Runner...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. The vulnerability is within the interactive web terminal allowing a malicious user with the developer role to open terminals on different developers...