vault vulnerabilities (Bitnami)
79 vulnerabilities.
-
vaultBitnami Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions 7.2 High -
vaultBitnami Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution 5.4 Medium -
vaultBitnami Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots 8.0 High -
vaultBitnami Vault PKI ACME Issues Certificate With Unvalidated SANs 5.9 Medium -
vaultBitnami Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths 6.8 Medium -
vaultBitnami Vault Enterprise vulnerable to cross-namespace entity deletion 8.2 High -
vaultBitnami Vault vulnerable to LIST authorization bypass via trailing-slash strip 4.3 Medium -
vaultBitnami Audit Log Plugin Directory Guard Bypass via Legacy path Option 4.4 Medium -
vaultBitnami Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations 7.5 High -
vaultBitnami Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header 7.5 High -
vaultBitnami Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS 5.3 Medium -
vaultBitnami Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service 8.1 High -
vaultBitnami Vault Vulnerable to Denial of Service Due to Rate Limit Regression 7.5 High -
vaultBitnami Vault AWS auth method bypass due to AWS client cache 8.1 High -
vaultBitnami Vault unauthenticated denial of service through complex json payload 7.5 High -
vaultBitnami Vault LDAP MFA Enforcement Bypass When Using Username As Alias 6.5 Medium -
vaultBitnami Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse 5.7 Medium -
vaultBitnami Timing Side-Channel in Vault’s Userpass Auth Method 3.7 Low -
vaultBitnami Vault Userpass and LDAP User Lockout Bypass 5.3 Medium -
vaultBitnami Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates 6.8 Medium -
vaultBitnami Vault TOTP Secrets Engine Code Reuse 6.5 Medium -
vaultBitnami Arbitrary Remote Code Execution via Plugin Catalog Abuse 9.1 Critical -
vaultBitnami Vault Root Namespace Operator May Elevate Token Privileges 7.2 High -
vaultBitnami Vault Vulnerable to Recovery Key Cancellation Denial of Service 3.1 Low -
vaultBitnami Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login 6.6 Medium -
vaultBitnami Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin 4.5 Medium -
vaultBitnami Vault Vulnerable to Denial of Service When Processing Raft Join Requests 7.5 High -
vaultBitnami Vault Operators in Root Namespace May Elevate Their Privileges 7.2 High -
vaultBitnami Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default 7.5 High -
vaultBitnami Vault Leaks AppRole Client Tokens And Accessor in Audit Log 6.2 Medium -
vaultBitnami Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior 7.5 High -
vaultBitnami Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims 2.6 Low -
vaultBitnami Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node 5.5 Medium -
vaultBitnami Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses 6.4 Medium -
vaultBitnami Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates 8.1 High -
vaultBitnami Vault May Expose Sensitive Information When Configuring An Audit Log Device 4.5 Medium -
vaultBitnami Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests 7.5 High -
vaultBitnami Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption 5.9 Medium -
vaultBitnami Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets 7.6 High -
vaultBitnami Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service 4.2 Medium -
vaultBitnami Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption 6.8 Medium -
vaultBitnami Vault's LDAP Auth Method Allows for User Enumeration 5.3 Medium -
vaultBitnami Vault Enterprise Namespace Creation May Lead to Denial of Service 4.9 Medium -
vaultBitnami Vault’s KV Diff Viewer Allowed for HTML Injection 4.3 Medium -
vaultBitnami Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM 2.5 Low -
vaultBitnami Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend 6.5 Medium -
vaultBitnami Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata 6.5 Medium -
vaultBitnami Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations 5.0 Medium -
vaultBitnami Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation 4.4 Medium -
vaultBitnami HashiCorp Vault's revocation list not respected 5.3 Medium - Show olderLoading…