Hashicorp vulnerabilities
139 CVEs and advisories name Hashicorp as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-10228Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user
- CVE-2024-9180Vault Operators in Root Namespace May Elevate Their Privileges
- CVE-2024-7594Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
- CVE-2024-8365Vault Leaks AppRole Client Tokens And Accessor in Audit Log
- CVE-2024-7625Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking
- CVE-2024-6717Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
- CVE-2024-6468Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior
- CVE-2024-6257HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
- CVE-2024-6104go-retryablehttp can leak basic auth credentials to log files
- CVE-2024-5798Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
- CVE-2024-2877Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node
- CVE-2024-3817HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
- CVE-2024-2660Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
- CVE-2024-2048Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
- CVE-2024-1329Nomad Vulnerable to Arbitrary Write Through Symlink Attack
- CVE-2024-1052Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
- CVE-2024-0831Vault May Expose Sensitive Information When Configuring An Audit Log Device
- CVE-2023-6337Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
- CVE-2023-5954Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
- CVE-2023-5834Vagrant’s Windows Installer Allowed Directory Junction Write
- CVE-2023-5077Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets
- CVE-2023-3775Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service
- CVE-2023-4680Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption
- CVE-2023-4782Terraform Allows Arbitrary File Write During Init Operation
- CVE-2023-3518JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
- CVE-2023-3462Vault's LDAP Auth Method Allows for User Enumeration
- CVE-2023-3774Vault Enterprise Namespace Creation May Lead to Denial of Service
- CVE-2023-3300Nomad Search API Leaks Information About CSI Plugins
- CVE-2023-3299Nomad Caller ACL Token's Secret ID is Exposed to Sentinel
- CVE-2023-3072Nomad ACL Policies without Label are Applied to Unexpected Resources