AZL-54009 CVE-2024-54132 affecting package gh for versions less than 2.13.0-23

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from ...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

MISP security vulnerabilities

MISP is an open source software solution from MISP Open Source. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP 2.5.2 and earlier versions,...

GitHub CLI Path Traversal Vulnerability

GitHub CLI is the GitHub CLI open source for GitHub on the command line. A path traversal vulnerability exists in GitHub CLI version 2.63.0 and earlier, which stems from the possibility that files may be created or overwritten in unintended directories when a user downloads a malicious GitHub...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using "--auth-mode=client", Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: "/api/v1/workflows/namespace/name" or when using...

com.lt-peacock:webdbviewer (>=1.0.0, <=1.0.2), ee.telekom.workflow:workflow-web (>=1.5.0, <=1.6.3) +5 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-taglibs (>=5.7.1, <=5.7.13)

org.springframework.security:spring-security-taglibs MAVEN version =5.7.1, =1.0.0, =1.5.0, =4.7.0, =4.7.0, =5.2.7, =5.7.2.release, =5.7.2.release, =5.7.4.release Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

PT-2024-9531

Name of the Vulnerable Software and Affected Versions GitHub CLI versions prior to 2.63.1 Description A security issue has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run...

Artifact poisoning vulnerability in action-download-artifact v5 and earlier

Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts such as malicious executables into a privileged...

GHSA-5XR6-XHWW-33M4 Artifact poisoning vulnerability in action-download-artifact v5 and earlier

Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts such as malicious executables into a privileged...

CVE-2024-52814

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

CVE-2024-52814 Helm Lacks Granularity in Workflow Role

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

CVE-2024-52814 Helm Lacks Granularity in Workflow Role

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

CVE-2024-52814 Helm Lacks Granularity in Workflow Role

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

CVE-2024-52814

CVE-2024-52814 — Helm (Argo) workflow-role privileges lack granularity : Affects Argo Helm prior to 0.45.0. The issue grants broad permissions in the workflow-role to all workflow Pods, not only those that require them, potentially impacting status reporting for certain Pods/Templates. Multiple s...

Argo Helm security vulnerabilities

Argo Helm is a community-maintained chartset open-sourced by the Argo Project. A security vulnerability exists in Argo Helm versions prior to 0.45.0 that stems from a lack of granularity in workflow-role permissions...

CVE-2024-52814: Insufficient Granularity of Access Control

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

PT-2024-35462 · Argo Helm · Argo Helm

Name of the Vulnerable Software and Affected Versions: Argo Helm versions prior to 0.45.0 Description: The issue is related to the workflow-role lacking granularity in its privileges, giving unnecessary permissions to workflowtasksets and workflowartifactgctasks for all workflow Pods. This could...

CVE-2024-52799

Argo Workflows Chart (Helm) prior to 0.44.0 has a vulnerable workflow-role with excessive privileges, including create pods/exec, enabling kubectl exec into any Pod in the same namespace and potentially arbitrary code execution if a user runs a malicious template. Affected charts are those using ...