CVE-2024-6468 Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxyprotocolbehavior, was set to denyunauthorized. When receiving a request from a source IP address that was not listed in proxyprotocolauthorizedaddrs, the Vault...

CVE-2024-6468 Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxyprotocolbehavior, was set to denyunauthorized. When receiving a request from a source IP address that was not listed in proxyprotocolauthorizedaddrs, the Vault...

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Summary Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxyprotocolbehavior, was set to denyunauthorized. When receiving a request from a source IP address that was not listed in proxyprotocolauthorizedaddrs, t...

PT-2024-5874 · Hashicorp +2 · Vault Enterprise +3

Name of the Vulnerable Software and Affected Versions: Vault and Vault Enterprise versions prior to 1.15.12 Vault and Vault Enterprise versions prior to 1.16.6 Vault and Vault Enterprise versions prior to 1.17.2 Description: The issue is related to the improper handling of requests originating fr...

HashiCorp Vault and HashiCorp Vault Enterprise Security Vulnerabilities

HashiCorp Vault and HashiCorp Vault Enterprise are both products of HashiCorp, Inc. of the U.S. HashiCorp Vault is a private key access management tool.HashiCorp Vault Enterprise is an enterprise information archiving platform. Captures information across all communication platforms - seamlessly...

CVE-2024-5798

A flaw was found in Hashicorp Vault. Vault and Vault Enterprise did not properly validate the JSON Web Token JWT role-bound audience claim when using the Vault JWT auth method. This issue may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an...

SUSE CVE-2024-2660

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

GO-2024-2921 HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault

HashiCorp Vault Incorrectly Validated JSON Web Tokens JWT Audience Claims in github.com/hashicorp/vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2485 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault

HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...

GO-2024-2511 Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault

Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault...

GO-2024-2508 Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault...

GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault

HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...

GO-2024-2514 Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault

Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault...

GO-2024-2486 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault

HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...

GO-2024-2509 Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault

Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: argo-events-fips, bank-vaults-fips, spire-server, crossplane-provider-family-azure, pulumi, tekton-chains-fips, fulcio, rabbitmq-messaging-topology-operator, k3d, neuvector-sigstore-interface, vexctl, ksops, cosign-fips, kargo, sigstore-scaffolding-fips,...

CVE-2024-6104 vulnerabilities

Vulnerabilities for packages: argo-events-fips, bank-vaults-fips, spire-server, crossplane-provider-family-azure, pulumi, tekton-chains-fips, fulcio, rabbitmq-messaging-topology-operator, k3d, neuvector-sigstore-interface, vexctl, ksops, cosign-fips, kargo, sigstore-scaffolding-fips,...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature...

CVE-2024-6057

CVE-2024-6057 affects Devolutions Remote Desktop Manager (RDM) 2024.1.31.0 and earlier, specifically the vault password feature. The underlying issue is improper authentication that could allow an attacker who already has access to an RDM instance to bypass the vault master password via the offli...