github.com/hashicorp/vault vulnerabilities (Go)
55 vulnerabilities.
-
github.com/hashicorp/vaultGo Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations 7.5 High -
github.com/hashicorp/vaultGo Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header 7.5 High -
github.com/hashicorp/vaultGo Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS 5.3 Medium -
github.com/hashicorp/vaultGo Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service 8.1 High -
github.com/hashicorp/vaultGo Vault Vulnerable to Denial of Service Due to Rate Limit Regression 7.5 High -
github.com/hashicorp/vaultGo Vault AWS auth method bypass due to AWS client cache 8.1 High -
github.com/hashicorp/vaultGo Vault unauthenticated denial of service through complex json payload 7.5 High -
github.com/hashicorp/vaultGo Vault LDAP MFA Enforcement Bypass When Using Username As Alias 6.5 Medium -
github.com/hashicorp/vaultGo Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse 5.7 Medium -
github.com/hashicorp/vaultGo Timing Side-Channel in Vault’s Userpass Auth Method 3.7 Low -
github.com/hashicorp/vaultGo Vault Userpass and LDAP User Lockout Bypass 5.3 Medium -
github.com/hashicorp/vaultGo Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates 6.8 Medium -
github.com/hashicorp/vaultGo Vault TOTP Secrets Engine Code Reuse 6.5 Medium -
github.com/hashicorp/vaultGo Arbitrary Remote Code Execution via Plugin Catalog Abuse 9.1 Critical -
github.com/hashicorp/vaultGo Vault Root Namespace Operator May Elevate Token Privileges 7.2 High -
github.com/hashicorp/vaultGo Vault Vulnerable to Recovery Key Cancellation Denial of Service 3.1 Low -
github.com/hashicorp/vaultGo Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login 6.6 Medium -
github.com/hashicorp/vaultGo Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin 4.5 Medium -
github.com/hashicorp/vaultGo Vault Vulnerable to Denial of Service When Processing Raft Join Requests 7.5 High -
github.com/hashicorp/vaultGo Vault Operators in Root Namespace May Elevate Their Privileges 7.2 High -
github.com/hashicorp/vaultGo Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default 7.5 High -
github.com/hashicorp/vaultGo Vault Leaks AppRole Client Tokens And Accessor in Audit Log 6.2 Medium -
github.com/hashicorp/vaultGo Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior 7.5 High -
github.com/hashicorp/vaultGo Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims 2.6 Low -
github.com/hashicorp/vaultGo Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses 6.4 Medium -
github.com/hashicorp/vaultGo Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates 8.1 High -
github.com/hashicorp/vaultGo Vault May Expose Sensitive Information When Configuring An Audit Log Device 4.5 Medium -
github.com/hashicorp/vaultGo Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests 7.5 High -
github.com/hashicorp/vaultGo Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption 5.9 Medium -
github.com/hashicorp/vaultGo Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets 7.6 High -
github.com/hashicorp/vaultGo Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption 6.8 Medium -
github.com/hashicorp/vaultGo Vault's LDAP Auth Method Allows for User Enumeration 5.3 Medium -
github.com/hashicorp/vaultGo Vault’s KV Diff Viewer Allowed for HTML Injection 4.3 Medium -
github.com/hashicorp/vaultGo Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend 6.5 Medium -
github.com/hashicorp/vaultGo Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata 6.5 Medium -
github.com/hashicorp/vaultGo Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations 5.0 Medium -
github.com/hashicorp/vaultGo Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation 4.4 Medium -
github.com/hashicorp/vaultGo HashiCorp Vault's revocation list not respected 5.3 Medium -
github.com/hashicorp/vaultGo HashiCorp Vault vulnerable to incorrect metadata access 9.1 Critical -
github.com/hashicorp/vaultGo HashiCorp Vault improper configuration of multi factor authentication 5.3 Medium -
github.com/hashicorp/vaultGo HashiCorp Vault Incorrect Permission Assignment for Critical Resource 6.5 Medium -
github.com/hashicorp/vaultGo Incorrect Privilege Assignment in HashiCorp Vault 8.1 High -
github.com/hashicorp/vaultGo Hashicorp Vault Privilege Escalation Vulnerability 2.9 Low -
github.com/hashicorp/vaultGo HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 4.4 Medium -
github.com/hashicorp/vaultGo Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault 5.3 Medium -
github.com/hashicorp/vaultGo Invalid session token expiration 7.4 High -
github.com/hashicorp/vaultGo Improper Authentication in HashiCorp Vault 7.5 High -
github.com/hashicorp/vaultGo Enumeration of users in HashiCorp Vault 5.3 Medium -
github.com/hashicorp/vaultGo Token leases could outlive their TTL in HashiCorp Vault 6.8 Medium -
github.com/hashicorp/vaultGo HashiCorp Vault Authentication bypass 8.2 High - Show olderLoading…