| CVE-2024-9180 |
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or…
|
7.2
Élevée
|
10 oct. 2024 |
| CVE-2024-7594 |
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default
|
7.5
Élevée
|
26 sept. 2024 |
| CVE-2024-8365 |
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive…
|
6.2
Moyenne
|
2 sept. 2024 |
| CVE-2024-6468 |
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP…
|
7.5
Élevée
|
11 juil. 2024 |
| CVE-2024-5798 |
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the…
|
2.6
Faible
|
12 juin 2024 |
| CVE-2024-2660 |
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more…
|
6.4
Moyenne
|
4 avr. 2024 |
| CVE-2024-2048 |
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when…
|
8.1
Élevée
|
4 mars 2024 |
| CVE-2024-0831 |
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies…
|
4.5
Moyenne
|
1 févr. 2024 |
| CVE-2023-6337 |
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of…
|
7.5
Élevée
|
8 déc. 2023 |
| CVE-2023-5954 |
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded…
|
5.9
Moyenne
|
9 nov. 2023 |
| CVE-2023-5077 |
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM…
|
7.6
Élevée
|
28 sept. 2023 |
| CVE-2023-4680 |
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even…
|
6.8
Moyenne
|
14 sept. 2023 |
| CVE-2023-3462 |
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method
|
5.3
Moyenne
|
31 juil. 2023 |
| CVE-2023-2121 |
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI…
|
4.3
Moyenne
|
9 juin 2023 |
| CVE-2023-0620 |
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when…
|
6.5
Moyenne
|
30 mars 2023 |
| CVE-2023-0665 |
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer…
|
6.5
Moyenne
|
30 mars 2023 |
| CVE-2023-25000 |
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to…
|
5.0
Moyenne
|
30 mars 2023 |
| CVE-2023-24999 |
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle…
|
4.4
Moyenne
|
10 mars 2023 |