CVE-2021-38698

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2...

CVE-2020-25201

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5...

CVE-2020-29564

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-28053

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...

CVE-2019-9764

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...

The vulnerability of the Consul and Consul Enterprise service configuration tool, which stems from insufficient validation of requests on the server side, allows attackers to carry out SSRF attacks.

The vulnerability of the Consul and Consul Enterprise service configuration tool is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to carry out an SSRF attack remotely...

The vulnerability of the NameHandler component of the Consul and Consul Enterprise service configuration tools allows a hacker to access potentially confidential information.

The vulnerability of the Name Handler component in the Consul and Consul Enterprise service configuration tool is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to access potentially confidential information...

ROS-20250402-07

A vulnerability in the Consul and Consul Enterprise service configuration tool is related to insufficient validation of user input. of user input. Exploitation of the vulnerability could allow an attacker acting remotely to launch an SSRF attack. remotely to launch an SSRF attack Vulnerability in...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in in the BeanDeserializer.deserializeFromArray function. By sending a...

Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1

Summary This SB contains a list for all CVE's listed here - CVE-2022-36083, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2021-21797, CVE-2022-35941, CVE-2021-42248, CVE-2021-42836, CVE-2022-40186, CVE-2022-41316, CVE-2021-36090, CVE-2020-29529, CVE-2020-7219 fixed in 3.5.1 Vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2022-24687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to...

Linux Distros Unpatched Vulnerability : CVE-2024-10005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in Consul and Consul Enterprise Consul such that using URL paths in L7 traffic intentions could bypass HTTP request path-based...

Linux Distros Unpatched Vulnerability : CVE-2021-41803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim...

Linux Distros Unpatched Vulnerability : CVE-2021-32574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject...

Linux Distros Unpatched Vulnerability : CVE-2024-10006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in Consul and Consul Enterprise Consul such that using Headers in L7 traffic intentions could bypass HTTP header based access...

Linux Distros Unpatched Vulnerability : CVE-2022-40716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling...

Linux Distros Unpatched Vulnerability : CVE-2022-29153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects...

Linux Distros Unpatched Vulnerability : CVE-2021-37219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: terragrunt, xcaddy, nri-haproxy, osv-scanner, velero, ip-masq-agent, kubernetes-ingress-defaultbackend, docker-credential-ecr-login, yq, amass, wave, kubernetes-csi-driver-hostpath, slsa-verifier, crossplane-provider-azure, vt-cli, s5cmd, dynamic-localpv-provisioner,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, metrics-server, kine, kubernetes-dns-node-cache, kyverno-policy-reporter-kyverno-plugin, nats-server, nri-haproxy, gcsfuse, esbuild, temporal-ui-server, sonobuoy, cni-plugins, aws-flb-cloudwatch, kubernetes-csi-external-resizer, mage, mongo-tool...