Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
linuxfoundation argo-cd vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2022-24905
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an malicious user to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to ex...
Linuxfoundation Argo-cd
6.1
CVSSv3
CVE-2022-31102
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and before 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an malicious user to inject arbitrary JavaScript in the `/auth/callback` page in a ...
Linuxfoundation Argo-cd
6.1
CVSSv3
CVE-2021-26924
An issue exists in Argo CD prior to 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.
Linuxfoundation Argo-cd
6.5
CVSSv3
CVE-2021-3557
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalation...
Linuxfoundation Argo-cd
Redhat Openshift Gitops 1.1
4.8
CVSSv3
CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd prior to 1.7.13, from 1.8.0 and prior to 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.
Linuxfoundation Argo Continuous Delivery
5.5
CVSSv3
CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows malicious user to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions before 1.8.7; 1.7 versions before 1.7.14.
Linuxfoundation Argo Continuous Delivery
6.5
CVSSv3
CVE-2021-26921
In util/session/sessionmanager.go in Argo CD prior to 1.8.4, tokens continue to work even when the user account is disabled.
Linuxfoundation Argo Continuous Delivery
6.5
CVSSv3
CVE-2023-25163
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logge...
Linuxfoundation Argo Continuous Delivery 2.6.0
9.6
CVSSv3
CVE-2023-40029
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 int...
Linuxfoundation Argo Continuous Delivery
6.5
CVSSv3
CVE-2023-40584
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file w...
Linuxfoundation Argo Continuous Delivery
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3380
CVE-2024-1694
local file inclusion
CVE-2024-5645
CVE-2024-24919
XSS
CVE-2024-36774
CVE-2024-21306
SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3