| CVE-2024-9180 |
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or…
|
7.2
High
|
Oct 10, 2024 |
| CVE-2024-7594 |
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default
|
7.5
High
|
Sep 26, 2024 |
| CVE-2024-8365 |
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive…
|
6.2
Medium
|
Sep 2, 2024 |
| CVE-2024-6468 |
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP…
|
7.5
High
|
Jul 11, 2024 |
| CVE-2024-5798 |
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the…
|
2.6
Low
|
Jun 12, 2024 |
| CVE-2024-2660 |
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more…
|
6.4
Medium
|
Apr 4, 2024 |
| CVE-2024-2048 |
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when…
|
8.1
High
|
Mar 4, 2024 |
| CVE-2024-0831 |
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies…
|
4.5
Medium
|
Feb 1, 2024 |
| CVE-2023-6337 |
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of…
|
7.5
High
|
Dec 8, 2023 |
| CVE-2023-5954 |
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded…
|
5.9
Medium
|
Nov 9, 2023 |
| CVE-2023-5077 |
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM…
|
7.6
High
|
Sep 28, 2023 |
| CVE-2023-4680 |
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even…
|
6.8
Medium
|
Sep 14, 2023 |
| CVE-2023-3462 |
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method
|
5.3
Medium
|
Jul 31, 2023 |
| CVE-2023-2121 |
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI…
|
4.3
Medium
|
Jun 9, 2023 |
| CVE-2023-0620 |
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when…
|
6.5
Medium
|
Mar 30, 2023 |
| CVE-2023-0665 |
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer…
|
6.5
Medium
|
Mar 30, 2023 |
| CVE-2023-25000 |
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to…
|
5.0
Medium
|
Mar 30, 2023 |
| CVE-2023-24999 |
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle…
|
4.4
Medium
|
Mar 10, 2023 |