PT-2020-19473 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.6.2 and earlier Description: The issue allows unbounded resource usage and is susceptible to unauthenticated denial of service. This affects the HTTP/RPC services of HashiCorp Consul and Consu...

PT-2020-19874 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.4.1 through 1.6.2 Description: The issue results from the non-uniform enforcement of Access Control Lists ACLs across all API endpoints, potentially leading to unintended information disclosur...

consul.group Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1033871 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

GHSA-8JHX-9GF4-HHF5 Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions...

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions...

Authentication Bypass

consul is vulnerable to authorization bypass. The vulnerability exists as the controller applies the :only and :except options of the last directive to all directives if it has multiple power directives set...

CVE-2019-16377

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

CVE-2019-16377

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

Improper access control

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

CVE-2019-16377

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

CVE-2019-16377

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

CVE-2019-16377

CVE-2019-16377 affects the makandra consul gem for Ruby (up to 1.0.2). The root cause is Incorrect/insufficient access control in controller power checks, where multiple :if/:except directives can cause skipped authentication, potentially allowing unauthorized access to controller actions. Affect...

CVE-2019-16377: Undefined Security Weakness

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control...

PT-2019-14649

Name of the Vulnerable Software and Affected Versions consul ruby gem versions prior to 1.0.3 Description The issue is related to Incorrect Access Control in the consul ruby gem. Specifically, when a controller checks multiple powers using :if or :except conditions, these conditions are applied t...

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions...

Mail.ru: Publicly Accessible Harshi Corp Consul

Consul interface was available from outside on one of my.com subdomains...

HashiCorp Consul Access Control Error Vulnerability

HashiCorp Consul is a distributed, highly available data center-aware solution. The product is used to connect and provision applications across dynamically distributed infrastructures. An access control error vulnerability exists in HashiCorp Consul versions 1.4.0 through 1.5.0. The vulnerabilit...

webd-consul-social.ldblog.jp Cross Site Scripting vulnerability

Security Researcher calv1n Helped patch 22043 vulnerabilities Received 12 Coordinated Disclosure badges Received 37 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting webd-consul-social.ldblog.jp website and its users...

Design/Logic Flaw

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured...

CVE-2019-12291

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured...