PT-2024-35462 · Argo Helm · Argo Helm

Name of the Vulnerable Software and Affected Versions: Argo Helm versions prior to 0.45.0 Description: The issue is related to the workflow-role lacking granularity in its privileges, giving unnecessary permissions to workflowtasksets and workflowartifactgctasks for all workflow Pods. This could...

CVE-2024-52799

Argo Workflows Chart (Helm) prior to 0.44.0 has a vulnerable workflow-role with excessive privileges, including create pods/exec, enabling kubectl exec into any Pod in the same namespace and potentially arbitrary code execution if a user runs a malicious template. Affected charts are those using ...

CVE-2024-52799 Argo Workflows Chart: Excessive Privileges in Workflow Role

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

CVE-2024-52799 Argo Workflows Chart: Excessive Privileges in Workflow Role

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

PT-2024-35450 · Unknown · Argo Workflows Chart

Name of the Vulnerable Software and Affected Versions: Argo Workflows Chart versions prior to 0.44.0 Description: The workflow-role in the Argo Workflows Chart has excessive privileges, including the ability to create pods/exec, which allows for arbitrary code execution within pods in the same...

CVE-2024-52799: Execution with Unnecessary Privileges

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

PT-2024-40635 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash involves functions such as zoom search again, ndpi detection...

datamorph-workflow-generator (0.0.2), i2b2-import (>=0.0.1, <=1.5.34) +1 more potentially affected by CVE-2024-45784 via airflow (0.6.0)

airflow PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on airflow and may be impacted: - datamorph-workflow-generator 0.0.2 - i2b2-import =0.0.1, =1.5.34 - pandasdb 0.0.10 Source cves: CVE-2024-45784 Source advisory:...

Business Logic Attacks Target Election-Related Sites on Election Day

As U.S. citizens headed to the polls, cyber threat activity against election-related websites was unusually high. One of the most prominent attack types observed this Election Day was business logic attacks —a complex threat that manipulates the intended workflow of applications, often without...

io.jenkins.plugins:pipeline-agent-build-history (28.vc1153328e666) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3883.vb_3ff2a_e3eea_f)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3883.vb3ff2ae3eeaf is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history...

io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b22, <=1.0.0-b24) +9 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.25)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b22, =1.0.0-b22, =1.0.0-b22,...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11-beta-2), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11-beta-2) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.11-beta-2)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.11-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.11-beta-2 -...

io.jenkins.plugins:pipeline-agent-build-history (>=16.vb_528eea_d8d6d, <=18.v66030db_e5f02), net.plavcak.jenkins:scmskip (50.vfb_3a_f04242a_a) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3826.v3b_5707fe44da)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3826.v3b5707fe44da is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.6, <=1.27.11), io.jenkins.plugins:code-coverage-api (>=4.8.0, <=4.99.0) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3691.v28b_14c465a_b_b)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3691.v28b14c465abb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.6,...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.12, <=1.27.16), io.jenkins.plugins:coverage (>=1.11.0, <=1.16.1) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3832.vc43e04d6d68c)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3832.vc43e04d6d68c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.12,...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.4.3-beta-1), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.4.3-beta-1) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.4.3-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.4.3-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.4.3-beta-1...

io.jenkins.blueocean:blueocean-pipeline-editor (>=0.1-preview-1, <=1.0-alpha-4), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.5) +6 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.23)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-editor =0.1-preview-1, =2.0.5,...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.12-beta-1), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.12-beta-1) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.12-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.12-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.12-beta-1 -...

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.2) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.11)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps-global-lib 2.2 Source cves:...

org.jenkins-ci.plugins:docker-workflow (>=1.7, <=1.9.1) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.7)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:docker-workflow =1.7, =1.9.1 Source cves:...