CVE-2024-22424

highpriority · track · 33EPSS 0.005 · 41 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (41st) EPSS

CVSS 8.3 · high

Is it mine?

57 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-24

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery (CSRF) attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo CD. A CSRF attack works by tricking an authenticated Argo CD user into loading a web page which contains code to call Argo CD API endpoints on the victim’s behalf. For example, an attacker could send an Argo CD user a link to a page which looks harmless but in the background calls an Argo CD API endpoint to create an application running malicious code. Argo CD uses the “Lax” SameSite cookie policy to prevent CSRF attacks where the attacker controls an external domain. The malicious external website can attempt to call the Argo CD API, but the web browser will refuse to send the Argo CD auth token with the request. Many companies host Argo CD on an internal subdomain. If an attacker can place malicious code on, for example, https://test.internal.example.com/, they can still perform a CSRF attack. In this case, the “Lax” SameSite cookie does not prevent the browser from sending the auth cookie, because the destination is a parent domain of the Argo CD API. Browsers generally block such attacks by applying CORS policies to sensitive requests with sensitive content types. Specifically, browsers will send a “preflight request” for POSTs with content type “application/json” asking the destination API “are you allowed to accept requests from my domain?” If the destination API does not answer “yes,” the browser will block the request. Before the patched versions, Argo CD did not validate that requests contained the correct content type header. So an attacker could bypass the browser’s CORS check by setting the content type to something which is considered “not sensitive” such as “text/plain.” The browser wouldn’t send the preflight request, and Argo CD would happily accept the contents (which are actually still JSON) and perform the requested action (such as running malicious code). A patch for this vulnerability has been released in the following Argo CD versions: 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15. The patch contains a breaking API change. The Argo CD API will no longer accept non-GET requests which do not specify application/json as their Content-Type. The accepted content types list is configurable, and it is possible (but discouraged) to disable the content type check completely. Users are advised to upgrade. There are no known workarounds for this vulnerability.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:13c7dfadcd85576a2f79d704e28f2c916286464b806ce3328024281244423b01_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:21f91c0f956e36a606219a73369103070ad6f9bff92a0af6ab152f93630197d0_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:6e7f6b372256c39b5a74810a491965ad1a89105f88e5f55ca3191afd930838ce_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:a8dce9168cf03484a56aa862b7500bdb4a9e80a1ecd204fffa55f54909f487b2_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argocd-rhel8@sha256:8d4868feea21ebb9f1d4a3219d876f9389fa94b4d8e4dd85356f38e2a7135f8c_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argocd-rhel8@sha256:9dd0b0138b8791e0f233242d0eb92f95326799339eea31c3874b7ed168b5d862_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argocd-rhel8@sha256:d297786472ffc986eb8f8a4868fb6a8c49c4361139482579a78323acc71ba3fb_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/argocd-rhel8@sha256:e435887e2da375262c6fc0176d6cebe3375ea2fbe1a086b035d84f61ecb1955e_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:32ce995c6dbdd506bff81400d41bc635a97a028d20ebdb19e59daa06225175ca_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:6c7c372b36170681c7f86399412faab8a26803e906d8bd390ecc7fa3f8ef1285_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:aea44e2daf40038000892958f8b79698c1bef84384e7f5776b889d88c7c57735_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:d6d309447163c48e2b4760d6d1d53edba85d4c6a19d05a6f97e71d3ff6828ad8_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/dex-rhel8@sha256:14e6353f7e5aaec49c035ed9c03665c89629f442ba3eab09ef58032f884cfe5b_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/dex-rhel8@sha256:a8aab064c6d0198eab3e103d7f53789c882285b3770f08ebe634d95375a0e1a8_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/dex-rhel8@sha256:de3c81e23a61b2b646f4849c0a8df96b42e0de1a702fc3e7c2fc534ac7a7779c_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/dex-rhel8@sha256:f0a3e008e266c48c909b29721c3ae69eecd73d5582b801fea1b393dee40e6b72_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:421fe7d0784d75becc79de029884306a0ec893e6dc73d437b206881e0905009b_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:0df27fe434f68d063c32c7390f41048d2573e02b366537205a400286d4ae15ba_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:267cf736e84991fa65b1b6a6b579b356ec6b11ef0c0b85342713415d9c7a8b7f_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:2ae3ea80cba9cc322d4f964d3421bdc9bebf71021a08e617f76158a03629cbe0_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:f35539fa04f8bf697a1f24c5a7b0ad0f3b610b8bfcc658f7d48d5bba9f50176f_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8@sha256:1bc463cbb8c066e703a3530b8a401f32e7414a426653099a2111a29bfac7c359_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8@sha256:3ce832faf77207d00b943ab2ed51dbd5c79e988fc9dea8783090b287dd20849b_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8@sha256:59224fd2a6ff599816448c5115f85ffd625c9e36c56c71ad0a9770b2d84e284b_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/gitops-rhel8@sha256:f4b555a9c81f7472e140a0590f4817f2da4152c90d62d7e4a49c3b9d8b21ea4b_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:123e2a5cd70d4762fe3debb90666413f19f327f9a9cff28f24103033c3faa9d1_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:5777a3d9ed2eb64e12a2d148b4740dcd25a447998c547bb969fd62261f796431_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:89b0829b7e0afb66e65b0aa8c60f4d8c3adaf1cd1a0cfc30034dc6937f9556b3_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:e955471c4ff57c9b5f7d2e1e305f2e74983eb5576486c469473af4ba93bc3bd5_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/must-gather-rhel8@sha256:1a02e5f8caffa0df5983e550b80440e33b4251cfe12307e0de7fdbbf68be6590_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/must-gather-rhel8@sha256:430e3fac540059d04cf2862f1e8d9ea20803d4924f1a65861d2e40517c17a196_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/must-gather-rhel8@sha256:46cc40820920270b820cd33c3212fb0faa1654a534787cc20f4b25946da3f14a_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689
Fixedopenshift-gitops-1/must-gather-rhel8@sha256:5a541be7dd4018fd8699be84cb43cc8d54777da835479a1e1afc63d4e790d046_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2024:0689

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.6 · impact 6

v3.18.3highAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 1.6 · impact 6

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · OSV

v3.17.6highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · Red Hat Product Security US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-352USprimaryCWE-352USCWE-352USCWE-352US

affected products (57)

Products and version ranges known to be affected.

Red Hat OpenShift GitOps <1.10.2all versionscert_bundDE
Red Hat OpenShift GitOps <1.11.1all versionscert_bundDE
Red Hat OpenShift GitOps <1.9all versionscert_bundDE
Red Hat OpenShift≤ GitOps <1.9cert_bundDE
Red Hat OpenShift≤ GitOps <1.10.2cert_bundDE
Red Hat OpenShift≤ GitOps <1.11.1cert_bundDE
argoproj argo-cdall versionsenisa_euvdEU
argoproj argo-cd0.1.0, → 2.7.15enisa_euvdEU
argoproj argo-cd2.10.0-rc1, → 2.10-rc2enisa_euvdEU
argoproj argo-cd2.8.0, → 2.8.8enisa_euvdEU
argoproj argo-cd2.9.0, → 2.9.4enisa_euvdEU
The Linux Foundation Argo CD≤ 2.8.7fstec_bduRU
The Linux Foundation Argo CD≤ 2.7.15fstec_bduRU
The Linux Foundation Argo CD≤ 2.9.3fstec_bduRU
The Linux Foundation Argo CD0.1.0 → 2.10.0-rc1fstec_bduRU
argoproj argo cd= 2.10.0nvdUScpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
argoproj argo cd2.8.0 → 2.8.8nvdUScpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
argoproj argo cd2.9.0 → 2.9.4nvdUScpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
linuxfoundation argo-cd0.1.0 → 2.7.16nvdUScpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*
Go github.com/argoproj/argo-cd0.1.0 → 1.8.7osvUSpkg:golang/github.com/argoproj/argo-cd

showing 20 of 57

advisories (3)

Vendor and ecosystem advisories describing this.

RHSA-2024:0689Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps 1.11.1 security update2024-02-05csaf · redhat_csafUS
An update is now available for Red Hat OpenShift GitOps v1.11. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-0697Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-03-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-92mw-q256-5vwggithub.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability2024-01-19ghsa · osvUS
### Impact The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16 are vulnerable to a cross-server request forgery (CSRF) attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo CD. A CSRF attack works by tricking an authenticated Argo CD user into loading a web page which contains code to call Argo CD API endpoints on the victim’s behalf. For example, an attacker could send an Argo CD user a link to a page which looks harmless but in the background calls an Argo CD API endpoint to create an application running malicious code. Argo CD uses the “Lax” SameSite cookie policy to prevent CSRF attacks where the attacker controls an external domain. The malicious external website can attempt to call the Argo CD API, but the web browser will refuse to send the Argo CD auth token with the request. Many companies host Argo CD on an internal subdomain, such as [https://argo-cd.internal.example.com](https://argo-cd.example.com/). If an attacker can place malicious code on, for example, https://test.internal.example.com/, they can still perform a CSRF attack. In this case, the “Lax” SameSite cookie does not prevent the browser from sending the auth cookie, because the destination is a parent domain of the Argo CD API. Browsers generally block such attacks by applying CORS policies to sensitive requests with sensitive content types. Specifically, browsers will send a “preflight request” for POSTs with content type “application/json” asking the destination API “are you allowed to accept requests from my domain?” If the destination API does not answer “yes,” the browser will block the request. Before the patched versions, Argo CD did not validate that requests contained the correct content type header. So an attacker could bypass the browser’s CORS check by setting the content type to something which is considered “not sensitive” such as “text/plain.” The browser wouldn’t send the preflight request, and Argo CD would happily accept the contents (which are actually still JSON) and perform the requested action (such as running malicious code). ### Patches A patch for this vulnerability has been released in the following Argo CD versions: * 2.10-rc2 * 2.9.4 * 2.8.8 * 2.7.16 🚨 **The patch contains a breaking API change.** 🚨 The Argo CD API will no longer accept non-GET requests which do not specify application/json as their Content-Type. The accepted content types list is configurable, and it is possible (but discouraged) to disable the content type check completely. ### Workarounds The only way to completely resolve the issue is to upgrade. ### Credits The Argo CD team would like to express their gratitude to An Trinh of [Calif](https://calif.io/) who reported the issue confidentially according to our [guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability) and published a helpful [blog post](https://blog.calif.io/p/argo-cd-csrf) to describe the issue. We would also like to thank them for actively participating in the review for the patch. ### References * The problem was originally reported in a [GitHub issue](https://github.com/argoproj/argo-cd/issues/2496)

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv redhat_csaf NVD CVE.org MITRE

published 2024-01-19modified 2026-06-17

related (10,342)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-62593US	high8.8OT critical	62.5% (99th)	KEV	2025-11-26
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox an…
CVE-2023-2533US	high8.8OT critical	28.8% (98th)	KEV	2023-06-20
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security se…
CVE-2020-10181US	critical9.8OT critical	14.9% (97th)	KEV	2020-03-11
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by…
CVE-2016-6277US	high8.8OT critical	99.8% (100th)	KEV	2016-12-14
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.…
CVE-2016-3718US	medium5.5OT critical	75.6% (100th)	KEV	2016-05-05
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted ima…

+10337 more

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan