CVE-2023-1296

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1...

CVE-2023-1296

Removed by vendor...

HashiCorp Nomad 安全漏洞

HashiCorp Nomad is a simple and flexible scheduler and orchestrator from HashiCorp USA. It is used to manage containerized and non-containerized applications at scale, both locally and in the cloud. A security vulnerability exists in HashiCorp Nomad , Nomad Enterprise versions 1.4.0 through 1.5.0...

CVE-2023-1296: Incorrect Calculation

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1...

HashiCorp Nomad 安全漏洞

HashiCorp Nomad is a simple and flexible scheduler and orchestrator from HashiCorp USA. It is used to manage containerized and non-containerized applications at scale, both locally and in the cloud. A security vulnerability exists in HashiCorp Nomad , Nomad Enterprise versions 1.4.0 through 1.5.0...

CVE-2023-1299: Missing Authorization

HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1...

PT-2023-16871 · Hashicorp · Hashicorp Nomad +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise version 1.5.0 Description: A job submitter can escalate to management-level privileges using workload identity and task API. This issue was introduced due to the exposure of the workload identity token to...

Nomad ACLs Can Not Deny Access to Workload's Own Variables

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and...

Nomad Job Submitter Privilege Escalation Using Workload Identity

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a user with the submit-job ACL capability can submit a job that can escalate to management-level privileges. This vulnerability, CVE-2023-1299, was introduced in Nomad 1.5.0 and fixed in Nomad 1.5.1. Background...

PT-2023-16869 · Hashicorp +1 · Nomad Enterprise +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.5.0 Description: A vulnerability was identified in Nomad and Nomad Enterprise such that a deny ACL capability could not be applied to a workload’s own variables. If included, the...

CVE-2022-34908

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization ...

CVE-2022-34909

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and retrieve data that is stored in the database...

CVE-2022-34910

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device...

CVE-2022-34908

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization ...

Aremis 4 Nomad 安全漏洞

Aremis 4 Nomad A4N is an application from Aremis, Inc. A security vulnerability exists in Aremis 4 Nomad version 1.5.0 that stems from passwords being stored in plaintext. An attacker exploiting this vulnerability could retrieve the passwords of other users using the same device...

CVE-2022-34910

The CVE-2022-34910 entry concerns the A4N (Aremis 4 Nomad) Android app 1.5.0, where user passwords are stored in cleartext in the local data store. This root cause enables any attacker with device access to retrieve other users’ passwords, describing a local, data-leak risk rather than a remote e...

CVE-2022-34909: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and retrieve data that is stored in the database...

PT-2023-13436

Name of the Vulnerable Software and Affected Versions A4N Aremis 4 Nomad application version 1.5.0 Description The issue allows SQL Injection, enabling an attacker to bypass authentication and retrieve data stored in the database. This can lead to unauthorized access to sensitive information...

CVE-2022-34910: Cleartext Storage of Sensitive Information

An issue was discovered in the A4N Aremis 4 Nomad application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device...

Aremis 4 Nomad 授权问题漏洞

Aremis 4 Nomad A4N is an application from Aremis, Inc. A security vulnerability exists in Aremis 4 Nomad version 1.5.0. An attacker exploits the vulnerability to send a simple HTTP request to the correct endpoint and gain authorization to retrieve application data...