alignak-backend (>=1.4.11, <=1.4.16), alignak-webui (>=0.11.1, <=0.12.2) +10 more potentially affected by unknown CVE via eve (>=0.6.4, <=1.1.5)

eve PYPI version =0.6.4, =1.4.11, =0.11.1, =0.1.6, =2.6.0, =0.1.0, =0.2.0, =0.5.0, =1.0.0b1, =0.4.2, =0.1.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: MEND:WS-2022-0390...

com.malliina:mobile-push_2.12 (1.12.5), com.malliina:play-social_2.12 (>=4.12.3, <=4.13.0) +4 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (5.12)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.malliina:mobile-push2.12 1.12.5 - com.malliina:play-social2.12 =4.12.3, =4.12.3, =0.0.11, =0.0.12 -...

BIT-VAULT-2025-3879 Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

GHSA-F9CH-H8J7-8JWG Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-3879

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

PT-2025-18909 · Hashicorp +1 · Vault Community Edition +2

Name of the Vulnerable Software and Affected Versions: Vault Community Edition versions prior to 1.19.1 Vault Enterprise versions prior to 1.19.1, 1.18.7, 1.17.14, 1.16.18 Description: The Azure Auth method in Vault did not correctly validate the claims in the Azure-issued token. This resulted in...

CVE-2025-3879: Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

com.malliina:mobile-push_2.12 (1.12.5), com.malliina:play-social_2.12 (>=4.12.3, <=4.13.0) +4 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (5.12)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.malliina:mobile-push2.12 1.12.5 - com.malliina:play-social2.12 =4.12.3, =4.12.3, =0.0.11, =0.0.12 -...

com.github.springbootplus:spring-boot-starter-allinone (2.0.1.release), com.malliina:mobile-push_2.12 (>=1.12.2, <=1.12.4) +7 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (5.9)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.springbootplus:spring-boot-starter-allinone 2.0.1.release - com.malliina:mobile-push2.12...

com.erudika:para-jar (>=1.30.0, <=1.30.2), com.erudika:para-server (>=1.29.2, <=1.30.2) +241 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (5.10)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.erudika:para-jar =1.30.0, =1.29.2, =1.29.2, =0.0.8, =0.0.9, =5.0.4.release1, =5.3.1, =5.3.1, =5.3.1,...

com.malliina:mobile-push_2.12 (1.12.5), com.malliina:play-social_2.12 (>=4.12.3, <=4.13.0) +4 more potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (5.12)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.malliina:mobile-push2.12 1.12.5 - com.malliina:play-social2.12 =4.12.3, =4.12.3, =0.0.11, =0.0.12 -...