Skip to contentHashicorp vulnerabilities
Newest
- hashicorp vault, vault enterprise +1 moreVault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby NodeCVE-2024-2877Fix available5.5 Medium
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesCVE-2024-3817Fix available9.8 Critical
- hashicorp vault, vault enterprise +1 moreVault TLS Cert Auth Method Did Not Correctly Validate OCSP ResponsesCVE-2024-2660Fix available6.4 Medium
- hashicorp vault, vault enterprise, openbao +2 moreVault Cert Auth Method Did Not Correctly Validate Non-CA CertificatesCVE-2024-2048Fix available8.1 High
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Arbitrary Write Through Symlink AttackCVE-2024-1329Fix available7.7 High
- hashicorp boundary, boundary enterprise +1 moreBoundary Vulnerable to Session Hijacking Through TLS Certificate TamperingCVE-2024-1052Fix available8.0 High
- hashicorp vault, vault enterprise +1 moreVault May Expose Sensitive Information When Configuring An Audit Log DeviceCVE-2024-0831Fix available4.5 Medium
- hashicorp vault, vault enterprise +1 moreVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsCVE-2023-6337Fix available7.5 High
- gitlab, hashicorp consul +1 moreDependency on Vulnerable Third-Party Component in GitLabCVE-2023-5332Fix available5.9 Medium
- hashicorp vault, vault enterprise +1 moreVault Requests Triggering Policy Checks May Lead To Unbounded Memory ConsumptionCVE-2023-5954Fix available5.9 Medium
- hashicorp vagrantVagrant’s Windows Installer Allowed Directory Junction WriteCVE-2023-5834Fix available3.8 Low
- hashicorp vault, vault enterprise +1 moreVault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating RolesetsCVE-2023-5077Fix available7.6 High
- hashicorp vault, vault enterprise +1 moreVault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of ServiceCVE-2023-3775Fix available4.2 Medium
- hashicorp vault, vault enterprise +1 moreVault's Transit Secrets Engine Allowed Nonce Specified without Convergent EncryptionCVE-2023-4680Fix available6.8 Medium
- hashicorp terraformTerraform Allows Arbitrary File Write During Init OperationCVE-2023-4782Fix available6.3 Medium
- hashicorp consul, consul enterprise +1 moreJWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for AccessCVE-2023-3518Fix available7.4 High
- hashicorp vault, vault enterprise +1 moreVault's LDAP Auth Method Allows for User EnumerationCVE-2023-3462Fix available5.3 Medium
- hashicorp vault, vault enterprise +1 moreVault Enterprise Namespace Creation May Lead to Denial of ServiceCVE-2023-3774Fix available4.9 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Search API Leaks Information About CSI PluginsCVE-2023-3300Fix available5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Caller ACL Token's Secret ID is Exposed to SentinelCVE-2023-3299Fix available3.4 Low
- hashicorp nomad, nomad enterprise +1 moreNomad ACL Policies without Label are Applied to Unexpected ResourcesCVE-2023-3072Fix available4.1 Medium
- hashicorp terraform enterpriseTerraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent PoolCVE-2023-31145.0 Medium
- hashicorp vault, vault enterprise +1 moreVault’s KV Diff Viewer Allowed for HTML InjectionCVE-2023-2121Fix available4.3 Medium
- hashicorp consul, consul enterprise +1 moreConsul Cluster Peering can Result in Denial of ServiceCVE-2023-1297Fix available4.9 Medium
- hashicorp consul, consul enterprise +1 moreConsul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerCVE-2023-2816Fix available8.7 High
- hashicorp vault, vault enterprise +1 moreVault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSMCVE-2023-2197Fix available2.5 Low
- hashicorp nomad, nomad enterprise +1 moreNomad Unauthenticated Client Agent HTTP Request Privilege EscalationCVE-2023-1782Fix available10.0 Critical
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage BackendCVE-2023-0620Fix available6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer MetadataCVE-2023-0665Fix available6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Cache-Timing Attacks During Seal and Unseal OperationsCVE-2023-25000Fix available5.0 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299Fix available7.4 High
- hashicorp nomad, nomad enterprise +1 moreNomad ACLs Can Not Deny Access to Workload's Own VariablesCVE-2023-1296Fix available2.7 Low
- hashicorp vault, vault enterprise +1 moreVault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy OperationCVE-2023-24999Fix available4.4 Medium
- hashicorp consul, consul enterprise +1 moreConsul Server Panic when Ingress and API Gateways Configured with PeeringCVE-2023-0845Fix available4.9 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Client Vulnerable to Decompression Bombs in Artifact BlockCVE-2023-0821Fix available6.5 Medium
- hashicorp go-getterGo-Getter Vulnerable to Decompression BombsCVE-2023-0475Fix available4.2 Medium
- hashicorp boundaryBoundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service ConfiguredCVE-2023-0690Fix available5.0 Medium
- hashicorp consul, consul enterprise +1 moreConsul Peering Imported Nodes/Services LeakCVE-2022-3920Fix available5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedCVE-2022-3867Fix available2.7 Low
- hashicorp nomad, nomad enterprise +1 moreNomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/CVE-2022-3866Fix available5.0 Medium
- hashicorp boundaryHashicorp Boundary vulnerable to clickjackingCVE-2022-361826.1 Medium
- hashicorp vaultHashiCorp Vault's revocation list not respectedCVE-2022-41316Fix available5.3 Medium
- hashicorp vagrantAn issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration...CVE-2022-42717Fix available7.8 High
- hashicorp nomadNomad Panics On Job Submission With Bad Artifact Stanza Source URLCVE-2022-41606Fix available6.5 Medium
- hashicorp consulHashiCorp Consul vulnerable to authorization bypassCVE-2022-40716Fix available6.5 Medium
- hashicorp consulHashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertionsCVE-2021-41803Fix available7.1 High
- hashicorp vaultHashiCorp Vault vulnerable to incorrect metadata accessCVE-2022-40186Fix available9.1 Critical
- hashicorp boundaryHashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the...CVE-2022-361309.9 Critical
- hashicorp consul templateHashiCorp Consul Template could reveal Vault secret contents in error messagesCVE-2022-38149Fix available7.5 High
- hashicorp vaultHashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control.CVE-2022-36129Fix available9.1 Critical
- Show moreLoading…