Filtered by vendor Hashicorp
Subscribe
Total
167 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-28348 | 1 Hashicorp | 1 Nomad | 2020-12-04 | 6.3 MEDIUM | 6.5 MEDIUM |
| HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8. | |||||
| CVE-2020-27195 | 1 Hashicorp | 1 Nomad | 2020-11-02 | 6.4 MEDIUM | 9.1 CRITICAL |
| HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6 | |||||
| CVE-2020-12757 | 1 Hashicorp | 1 Vault | 2020-10-12 | 7.5 HIGH | 9.8 CRITICAL |
| HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2. | |||||
| CVE-2020-24359 | 1 Hashicorp | 1 Vault-ssh-helper | 2020-08-26 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0. | |||||
| CVE-2019-12291 | 1 Hashicorp | 1 Consul | 2020-08-24 | 6.4 MEDIUM | 7.5 HIGH |
| HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. | |||||
| CVE-2019-8336 | 1 Hashicorp | 1 Consul | 2020-08-24 | 6.8 MEDIUM | 8.1 HIGH |
| HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances. | |||||
| CVE-2019-9764 | 1 Hashicorp | 1 Consul | 2020-08-24 | 5.8 MEDIUM | 7.4 HIGH |
| HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4. | |||||
| CVE-2019-12618 | 1 Hashicorp | 1 Nomad | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. | |||||
| CVE-2020-13170 | 1 Hashicorp | 1 Consul | 2020-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. | |||||
| CVE-2020-12758 | 1 Hashicorp | 1 Consul | 2020-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. | |||||
| CVE-2020-10944 | 1 Hashicorp | 1 Nomad | 2020-05-06 | 3.5 LOW | 5.4 MEDIUM |
| HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5. | |||||
| CVE-2020-10660 | 1 Hashicorp | 1 Vault | 2020-03-30 | 4.3 MEDIUM | 5.3 MEDIUM |
| HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4. | |||||
| CVE-2020-10661 | 1 Hashicorp | 1 Vault | 2020-03-25 | 5.8 MEDIUM | 9.1 CRITICAL |
| HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4. | |||||
| CVE-2019-19879 | 1 Hashicorp | 1 Sentinel | 2020-02-25 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. | |||||
| CVE-2020-7956 | 1 Hashicorp | 1 Nomad | 2020-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3. | |||||
| CVE-2017-16873 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | 7.2 HIGH | 7.8 HIGH |
| It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges. | |||||
| CVE-2017-16839 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | 6.9 MEDIUM | 7.0 HIGH |
| Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed. | |||||
| CVE-2017-15884 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | 6.9 MEDIUM | 7.0 HIGH |
| In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges. | |||||
| CVE-2017-12579 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | 7.2 HIGH | 7.8 HIGH |
| An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell. | |||||
| CVE-2017-16777 | 1 Hashicorp | 1 Vagrant | 2019-10-03 | 7.2 HIGH | 7.8 HIGH |
| If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root. | |||||