github.com/argoproj/argo-cd/v2 vulnerabilities (Go)
51 vulnerabilities.
-
github.com/argoproj/argo-cd/v2Go Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks 9.9 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL 8.8 High -
github.com/argoproj/argo-cd/v2Go Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation 7.3 High -
github.com/argoproj/argo-cd/v2Go Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations 6.3 Medium -
github.com/argoproj/argo-cd/v2Go ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction 9.6 Critical -
github.com/argoproj/argo-cd/v2Go In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext... 7.7 High -
github.com/argoproj/argo-cd/v2Go Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook 7.5 High -
github.com/argoproj/argo-cd/v2Go argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload 7.5 High -
github.com/argoproj/argo-cd/v2Go Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload 7.5 High -
github.com/argoproj/argo-cd/v2Go Repository Credentials Race Condition Crashes Argo CD Server 6.5 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD: Project API Token Exposes Repository Credentials 10.0 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD allows cross-site scripting on repositories page 9.1 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD does not scrub secret values from patch errors 6.8 Medium -
github.com/argoproj/argo-cd/v2Go The Argo CD web terminal session does not handle the revocation of user permissions properly. 4.7 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint 7.5 High -
github.com/argoproj/argo-cd/v2Go Unauthenticated Access to sensitive settings in Argo CD 5.3 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD allows authenticated users to enumerate clusters by name 4.3 Medium -
github.com/argoproj/argo-cd/v2Go ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache 9.1 Critical -
github.com/argoproj/argo-cd/v2Go Denial of Service via malicious jqPathExpressions in ignoreDifferences 6.5 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD' API server does not enforce project sourceNamespaces 4.8 Medium -
github.com/argoproj/argo-cd/v2Go Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server 6.5 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment 7.5 High -
github.com/argoproj/argo-cd/v2Go Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow 7.5 High -
github.com/argoproj/argo-cd/v2Go Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss 9.8 Critical -
github.com/argoproj/argo-cd/v2Go Users with `create` but not `override` privileges can perform local sync in argo-cd 6.4 Medium -
github.com/argoproj/argo-cd/v2Go Cross-site scripting on application summary component in argo-cd 9.1 Critical -
github.com/argoproj/argo-cd/v2Go Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd 8.4 High -
github.com/argoproj/argo-cd/v2Go Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server 5.0 Medium -
github.com/argoproj/argo-cd/v2Go Denial of Service to Argo CD repo-server 6.5 Medium -
github.com/argoproj/argo-cd/v2Go Cluster secret might leak in cluster details page in Argo CD 9.9 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD web terminal session doesn't expire 4.7 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD authenticated but unauthorized users may enumerate Application names via the API 4.3 Medium -
github.com/argoproj/argo-cd/v2Go Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets 9.1 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD leaks repository credentials in user-facing error messages and in logs 6.3 Medium -
github.com/argoproj/argo-cd/v2Go argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled 8.6 High -
github.com/argoproj/argo-cd/v2Go JWT audience claim is not verified 9.1 Critical -
github.com/argoproj/argo-cd/v2Go Cross-site Scripting for Argo CD single sign on users 2.6 Low -
github.com/argoproj/argo-cd/v2Go Argo CD's certificate verification is skipped for connections to OIDC providers 8.3 High -
github.com/argoproj/argo-cd/v2Go Argo CD vulnerable to Uncontrolled Memory Consumption 6.5 Medium -
github.com/argoproj/argo-cd/v2Go Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server 4.3 Medium -
github.com/argoproj/argo-cd/v2Go External URLs for Deployments can include javascript in argo-cd 9.0 Critical -
github.com/argoproj/argo-cd/v2Go Insecure entropy in argo-cd 8.3 High -
github.com/argoproj/argo-cd/v2Go Argo CD will blindly trust JWT claims if anonymous access is enabled 10.0 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD login screen allows message spoofing if SSO is enabled 4.3 Medium -
github.com/argoproj/argo-cd/v2Go Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server 4.3 Medium -
github.com/argoproj/argo-cd/v2Go Improper access control allows admin privilege escalation in Argo CD 9.9 Critical -
github.com/argoproj/argo-cd/v2Go Argo CD improper access control bug can allow malicious user to escalate privileges to admin level 8.8 High -
github.com/argoproj/argo-cd/v2Go Path traversal allows leaking out-of-bound files from Argo CD repo-server 6.8 Medium -
github.com/argoproj/argo-cd/v2Go Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server 7.7 High -
github.com/argoproj/argo-cd/v2Go Path traversal and dereference of symlinks in Argo CD 7.7 High - Show olderLoading…