Skip to contentArgoproj vulnerabilities
Newest
- argoproj argo-cd, argo cd +1 moreCross-site scripting on application summary component in argo-cdCVE-2024-28175Fix available9.1 Critical
- argoproj argo-cd, argo cd +1 moreCross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cdCVE-2024-22424Fix available8.4 High
- argoproj argo cd, argo-cd +1 morePath traversal allows leaking out-of-bound Helm charts from Argo CD repo-serverCVE-2023-40026Fix available5.0 Medium
- argoproj argo cd, argo-cd +1 moreDenial of Service to Argo CD repo-serverCVE-2023-40584Fix available6.5 Medium
- argoproj argo cd, argo-cd +1 moreCluster secret might leak in cluster details page in Argo CDCVE-2023-40029Public exploitFix available9.9 Critical
- argoproj argo cd, argo-cd +1 moreArgo CD web terminal session doesn't expireCVE-2023-40025Fix available4.7 Medium
- argoproj argo cd, argo-cd +1 moreArgo CD users with any cluster secret update access may update out-of-bounds cluster secretsCVE-2023-23947Fix available9.1 Critical
- argoproj argo cd, argo-cd +1 moreArgo CD leaks repository credentials in user-facing error messages and in logsCVE-2023-25163Fix available6.3 Medium
- argoproj argo-cd, argo cd +1 moreargo-cd Controller reconciles apps outside configured namespaces when sharding is enabledCVE-2023-22736Fix available8.6 High
- argoproj argo cd, argo-cd +1 moreJWT audience claim is not verifiedCVE-2023-22482Fix available9.1 Critical
- argoproj argo cd, argo-cd +1 moreCross-site Scripting for Argo CD single sign on usersCVE-2022-31102Fix available2.6 Low
- argoproj argo cd, argo-cd +1 moreArgo CD's certificate verification is skipped for connections to OIDC providersCVE-2022-31105Fix available8.3 High
- argoproj argo cd, argo-cd +1 moreArgo CD vulnerable to Uncontrolled Memory ConsumptionCVE-2022-31016Fix available6.5 Medium
- argoproj argo cd, argo-cd +1 moreSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverCVE-2022-31036Fix available4.3 Medium
- argoproj argo-cd, argo cd +1 moreExternal URLs for Deployments can include javascript in argo-cdCVE-2022-31035Fix available9.0 Critical
- argoproj argo-cd, argo cd +1 moreInsecure entropy in argo-cdCVE-2022-31034Fix available8.3 High
- argo events project events, argoproj argo-events +1 moreUses of deprecated API can be used to cause DoS in user-facing endpoints in Argo EventsCVE-2022-31054Fix available7.5 High
- argoproj argo cd, argo-cd +1 moreArgo CD will blindly trust JWT claims if anonymous access is enabledCVE-2022-29165Fix available10.0 Critical
- argoproj argo cd, argo-cd +1 moreArgo CD login screen allows message spoofing if SSO is enabledCVE-2022-24905Fix available4.3 Medium
- argoproj argo cd, argo-cd +1 moreSymlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverCVE-2022-24904Fix available4.3 Medium
- argoproj argo-workflows, argo workflows +1 morePrivilege Escalation in argo-workflowsCVE-2022-29164Fix available7.1 High
- argoproj argo cd, argo-cd +1 moreImproper access control allows admin privilege escalation in Argo CDCVE-2022-24768Fix available9.9 Critical
- argoproj argo cdArgo CD improper access control bug can allow malicious user to escalate privileges to admin levelCVE-2022-1025Fix available8.8 High
- argoproj argo cd, argo-cd +1 morePath traversal allows leaking out-of-bound files from Argo CD repo-serverCVE-2022-24731Fix available6.8 Medium
- argoproj argo cd, argo-cd +1 morePath traversal and improper access control allows leaking out-of-bound files from Argo CD repo-serverCVE-2022-24730Fix available7.7 High
- argoproj argo cd, redhat openshift gitops +1 moreA flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and...CVE-2021-35576.5 Medium
- argoproj argo cdPath traversal and dereference of symlinks in Argo CDCVE-2022-24348Public exploitFix available7.7 High
- argoproj argo workflowsWorkflow re-write vulnerability using input parameterCVE-2021-37914Fix available6.5 Medium
- argo cd cd, argoproj argo cd +1 moreArgo CD leaked secret data into error messages and logs on invalid edits via UICVE-2021-23135Fix available5.9 Medium
- argoproj argo cdAn issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.CVE-2021-269246.1 Medium
- argoproj argo cdAn issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication.CVE-2021-269237.5 High
- argoproj argo cdCross-site Scripting (XSS)CVE-2021-23347Fix available4.7 Medium
- argoproj argo cdIn util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.CVE-2021-26921Fix available6.5 Medium
- argoproj argo cdArgo Exposure of Sensitive InformationCVE-2018-21034Fix available6.5 Medium
- argoproj argo cdArgo CD Insecure default administrative passwordCVE-2020-8828Fix available8.8 High
- argoproj argo cdImproper Restriction of Excessive Authentication Attempts in Argo APICVE-2020-8827Fix available7.5 High
- argoproj argo cdAs of v1.5.0, the Argo web interface authentication system issued immutable tokens....CVE-2020-8826Fix available7.5 High
- argoproj argo cdObservable Discrepancy in ArgoCVE-2020-11576Fix available5.3 Medium