GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: k3d, velero, nats-server, prometheus-adapter-fips, vite, dockerize, aws-load-balancer-controller, vt-cli, configmap-reload-fips, haproxy-ingress, aws-flb-kinesis, cert-exporter-fips, nats, cluster-proportional-autoscaler, nri-nginx, envoy-ratelimit,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: k3d, velero, nats-server, prometheus-adapter-fips, vite, dockerize, aws-load-balancer-controller, vt-cli, configmap-reload-fips, haproxy-ingress, aws-flb-kinesis, cert-exporter-fips, nats, cluster-proportional-autoscaler, nri-nginx, envoy-ratelimit,...

Exploit for Incorrect Authorization in Hashicorp Consul

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING...

GLSA-202412-14 : HashiCorp Consul: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-14 HashiCorp Consul: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding descriptio...

HashiCorp Consul: Multiple Vulnerabilities

Background HashiCorp Consul is a tool for service discovery, monitoring and configuration. Description Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

The vulnerability of the Consul service configuration tool lies in the incorrect limitation of the path name to the restricted catalog, allowing attackers to circumvent security restrictions.

The vulnerability of the Consul service configuration tool is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTTP request...

The vulnerability of the Consul service configuration tool arises from the lack of measures taken to protect the structure of web pages. This allows attackers to carry out XSS attacks.

The vulnerability of the Consul service configuration tool exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

GoCast NAT parameter OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-1961 GoCast NAT parameter OS command injection vulnerability November 21, 2024 CVE Number CVE-2024-29224 SUMMARY An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command...

ROS-20241121-06

A vulnerability in the Consul service configuration tool is related to the use of URL paths in L7 traffic. Exploitation of the vulnerability could allow an attacker acting remotely to bypass access rules based on HTTP request paths. HTTP request paths The vulnerability in the Consul service...

The vulnerability of the Consul Community Edition and Consul Enterprise configuration tools lies in their failure to remove HTTP headers from script syntax, allowing attackers to gain access to confidential information.

The vulnerability of the Consul service configuration tool lies in the lack of measures taken to neutralize HTTP headers in script syntax. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential information through a specially crafted HTTP reques...

ROS-20241112-09

A vulnerability in the Consul service configuration tool is related to input validation errors when processing catalog traversal sequences. Exploitation of the vulnerability could allow an attacker acting remotely to send a specially crafted HTTP request and read arbitrary files on the system...

Improper Access Control

github.com/hashicorp/consul is vulnerable to Improper Access Control. The vulnerability is due to the ability to bypass HTTP header-based access rules when using headers in L7 traffic intentions, allowing unauthorized access in certain cases...

Cross-site Scripting (XSS)

github.com/hashicorp/consul is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the server's failure to explicitly set a Content-Type HTTP header in the response, allowing user-provided inputs to be misinterpreted, which can lead to reflected XSS attacks...

Path Traversal

github.com/hashicorp/consul is vulnerable to Path Traversal. The vulnerability is due to the bypass of HTTP request path-based access rules when using URL paths in L7 traffic intentions, allowing unauthorized access in specific scenarios...

SUSE CVE-2024-10086

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

GO-2024-3243 Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul

Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul...

GO-2024-3242 Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul

Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...

GO-2024-3241 Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul...

BIT-CONSUL-2024-10005 Consul L7 Intentions Vulnerable To URL Path Bypass

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules...

BIT-CONSUL-2024-10006 Consul L7 Intentions Vulnerable To Headers Bypass

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using Headers in L7 traffic intentions could bypass HTTP header based access rules...