boundary

Boundary ما هو Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary الموقع الإلكتروني: https://www.developer.hashicorp.com/boundary/ المنتديات: HashiCorp Discuss التوثيق: https://developer.hashicorp.com/boundary/docs الدروس التعليمية: منصة HashiCorp التعليمية Boundary هو بروكس...

Alibaba Sentinel - Server-side request forgery (SSRF)

There is a Pre-Auth SSRF vulnerability in Alibaba Sentinel version 1.8.2, which allows remote unauthenticated attackers to perform SSRF attacks via the /registry/machine endpoint through the ip parameter. id: CVE-2021-44139 info: name: Alibaba Sentinel - Server-side request forgery SSRF author:...

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting

HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value KV raw mode. id: CVE-2020-25864 info: name: HashiCorp Consul/Consul Enterprise =1.9.4 - Cross-Site Scripting author: c-sh0 severity: medium description: | HashiCorp Consul and Consu...

vault

Vault कृपया ध्यान दें : हम Vault की सुरक्षा और अपने उपयोगकर्ताओं के विश्वास को बहुत गंभीरता से लेते हैं। यदि आपको लगता है कि आपको Vault में कोई सुरक्षा समस्या मिली है, तो कृपया [email protected] पर हमसे संपर्क करके जिम्मेदारी से खुलासा करें. वेबसाइट : developer.hashicorp.com/vault घोषणा सूची...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE через API HashiCorp Consul Enterprise до версии 1.8.17, 1.9.x до 1.9.11 и 1.10.x до 1.10.4 имеет некорректный контроль доступа. Токен ACL с разрешениями operator:write по умолчанию в одном пространстве имен может быть использован для непреднамеренного повышения...

intercept

!zreadhttps://img.shields.io/badge/AskZread-.svg?style=plastic&color=00b0aa&labelColor=000000&logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTQuOTYxNTYgMS42MDAxSDIuMjQxNTZD...

grove

Grove è un framework di raccolta log per Software as a Service SaaS, progettato per supportare la raccolta di log da servizi che non supportano nativamente lo streaming dei log. Grove consente ai team di raccogliere eventi relativi alla sicurezza dai propri fornitori in modo affidabile e coerente...

decker

Decker - Penetration Testing Orchestration Framework Purpose Decker is a penetration testing orchestration framework. It leverages HashiCorp Configuration Language 2 the same config language as Terraform to allow declarative penetration testing as code, so your tests can be versioned, shared,...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING DISCLAIMER LEGALE: Questo strumento è ESCLUSIVAMENTE PER SCOPI EDUCATIVI! L'uso di questo strumento per attaccare obiettivi senza previo consenso reciproco è ILLEGALE. È responsabilità dell'utente rispettare tutte le leggi applicabili...

Security Bulletin: Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

EUVD-2026-65122

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-14361

CVE-2026-14361 L'helper writeToFile di Consul Template apriva direttamente una destinazione fornita dall'operatore e seguiva i componenti di percorso linkati, consentendo all'output renderizzato di fuoriuscire dalla directory prevista e sovrascrivere un file preesistente. Introduzione Ho trovato...

CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...