| CVE-2025-4166 |
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in…
|
4.5
Moyenne
|
2 mai 2025 |
| CVE-2024-8185 |
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a…
|
7.5
Élevée
|
31 oct. 2024 |
| CVE-2024-9180 |
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or…
|
7.2
Élevée
|
10 oct. 2024 |
| CVE-2024-7594 |
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default
|
7.5
Élevée
|
26 sept. 2024 |
| CVE-2024-8365 |
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive…
|
6.2
Moyenne
|
2 sept. 2024 |
| CVE-2024-6468 |
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP…
|
7.5
Élevée
|
11 juil. 2024 |
| CVE-2024-5798 |
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the…
|
2.6
Faible
|
12 juin 2024 |
| CVE-2024-2877 |
Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log…
|
5.5
Moyenne
|
30 avr. 2024 |
| CVE-2024-2660 |
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more…
|
6.4
Moyenne
|
4 avr. 2024 |
| CVE-2024-2048 |
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when…
|
8.1
Élevée
|
4 mars 2024 |
| CVE-2024-0831 |
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies…
|
4.5
Moyenne
|
1 févr. 2024 |
| CVE-2023-6337 |
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of…
|
7.5
Élevée
|
8 déc. 2023 |
| CVE-2023-5954 |
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded…
|
5.9
Moyenne
|
9 nov. 2023 |
| CVE-2023-5077 |
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM…
|
7.6
Élevée
|
28 sept. 2023 |
| CVE-2023-3775 |
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one…
|
4.2
Moyenne
|
28 sept. 2023 |
| CVE-2023-4680 |
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even…
|
6.8
Moyenne
|
14 sept. 2023 |
| CVE-2023-3462 |
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method
|
5.3
Moyenne
|
31 juil. 2023 |
| CVE-2023-3774 |
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially…
|
4.9
Moyenne
|
28 juil. 2023 |
| CVE-2023-2121 |
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI…
|
4.3
Moyenne
|
9 juin 2023 |
| CVE-2023-2197 |
HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction…
|
2.5
Faible
|
1 mai 2023 |
| CVE-2023-0620 |
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when…
|
6.5
Moyenne
|
30 mars 2023 |
| CVE-2023-0665 |
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer…
|
6.5
Moyenne
|
30 mars 2023 |
| CVE-2023-25000 |
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to…
|
5.0
Moyenne
|
30 mars 2023 |
| CVE-2023-24999 |
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle…
|
4.4
Moyenne
|
10 mars 2023 |