Hashicorp vulnerabilities
139 CVEs and advisories name Hashicorp as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-3114Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool
- CVE-2023-2121Vault’s KV Diff Viewer Allowed for HTML Injection
- CVE-2023-1297 Consul Cluster Peering can Result in Denial of Service
- CVE-2023-2816Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
- CVE-2023-2197Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
- CVE-2023-1782Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation
- CVE-2023-0620Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend
- CVE-2023-0665Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
- CVE-2023-25000Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
- CVE-2023-1299Nomad Job Submitter Privilege Escalation Using Workload Identity
- CVE-2023-1296Nomad ACLs Can Not Deny Access to Workload's Own Variables
- CVE-2023-24999Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation
- CVE-2023-0845Consul Server Panic when Ingress and API Gateways Configured with Peering
- CVE-2023-0821Nomad Client Vulnerable to Decompression Bombs in Artifact Block
- CVE-2023-0475Go-Getter Vulnerable to Decompression Bombs
- CVE-2023-0690Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
- CVE-2022-3920Consul Peering Imported Nodes/Services Leak
- CVE-2022-3867Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected
- CVE-2022-3866Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/