1221 matches found
GO-2024-2505 Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul
Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2501 Denial of service in HashiCorp Consul in github.com/hashicorp/consul
Denial of service in HashiCorp Consul in github.com/hashicorp/consul...
Malicious code in bosh-cli_plugin_consul (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in consul-nspaces (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2021 Malicious code in consul-nspaces (npm)
--- -= Per source details. Do not edit below this line.=-...
GHSA-V6V8-XJ6M-XWQH vulnerabilities
Vulnerabilities for packages: spire-server-fips, timestamp-authority, pulumi-kubernetes-operator, fulcio, opentelemetry-collector-fips, src-fingerprint-fips, flux-notification-controller, buildkitd, src-fingerprint, flux-kustomize-controller, crossplane-provider-azure-storage, sops,...
GO-2024-2704 Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul...
Fedora 37 : moby-engine (2023-fde38dda12)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fde38dda12 advisory. update to 20.10.22 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...
GHSA-M9W6-WP3H-VQ8G vulnerabilities
Vulnerabilities for packages: juicefs, cloudflared, kubernetes-dns-node-cache...
CVE-2024-0874 vulnerabilities
Vulnerabilities for packages: juicefs, cloudflared, kubernetes-dns-node-cache...
GO-2024-2683 Improper handling of node names in JWT claims assertions in github.com/hashicorp/consul
HashiCorp Consul does not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC...
BIT-GITLAB-2023-5332 Dependency on Vulnerable Third-Party Component in GitLab
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE...
BIT-CONSUL-2020-12758
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4...
BIT-CONSUL-2020-12797
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4...
BIT-CONSUL-2020-13170
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4...
BIT-CONSUL-2020-13250
HashiCorp Consul and Consul Enterprise include an HTTP API introduced in 1.2.0 and DNS introduced in 1.4.3 caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4...
BIT-CONSUL-2020-25201
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5...
BIT-CONSUL-2020-25864
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value KV raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14...
BIT-CONSUL-2020-28053
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6...