Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
linuxfoundation argo continuous delivery vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-40584
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file w...
Linuxfoundation Argo Continuous Delivery
4
CVSSv2
CVE-2018-21034
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
Linuxfoundation Argo Continuous Delivery
5
CVSSv2
CVE-2021-26921
In util/session/sessionmanager.go in Argo CD prior to 1.8.4, tokens continue to work even when the user account is disabled.
Linuxfoundation Argo Continuous Delivery
3.5
CVSSv2
CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd prior to 1.7.13, from 1.8.0 and prior to 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.
Linuxfoundation Argo Continuous Delivery
2.1
CVSSv2
CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows malicious user to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions before 1.8.7; 1.7 versions before 1.7.14.
Linuxfoundation Argo Continuous Delivery
5
CVSSv2
CVE-2020-8826
As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
Linuxfoundation Argo Continuous Delivery
6.5
CVSSv2
CVE-2020-8828
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are n...
Linuxfoundation Argo Continuous Delivery
NA
CVE-2023-40029
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 int...
Linuxfoundation Argo Continuous Delivery
5
CVSSv2
CVE-2020-8827
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Linuxfoundation Argo Continuous Delivery
NA
CVE-2023-25163
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logge...
Linuxfoundation Argo Continuous Delivery 2.6.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925
CVE-2023-41826
LFI
CVE-2022-22364
CVE-2024-2887
command injection
remote code execution
CVE-2024-34446
CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »