BIT-VAULT-2024-2877 Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

BIT-VAULT-2024-2048 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass...

BIT-VAULT-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2877

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

CVE-2024-2877 Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

CVE-2024-2877 Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

CVE-2024-2877 Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

CVE-2024-2877

Summary: CVE-2024-2877 affects Vault Enterprise when configured with performance standby nodes and a configured audit device, causing inadvertent logging of HTTP request headers on the standby node in cleartext. Affected component: Vault Enterprise (standby/log audit path). Root cause / impact: S...

Vault Enterprise Leaks Sensitive HTTP Request Headers in Audit Log When Deployed With a Performance Standby Node

Summary Vault Enterprise, when configured with both performance standby nodes and an audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request header information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault...

HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise is an enterprise information archiving platform from HashiCorp USA. Captures information across all communication platforms - seamlessly migrating information from local to the cloud and automatically identifying the most relevant content to ensure regulatory compliance...

PT-2024-22569 · Hashicorp · Vault Enterprise

Name of the Vulnerable Software and Affected Versions: Vault Enterprise versions prior to 1.15.8 Description: The issue arises when Vault Enterprise is configured with performance standby nodes and a configured audit device, causing it to inadvertently log request headers on the standby node. The...

The vulnerability in the TLS certificate verification component of HashiCorp Vault and Vault Enterprise, a platform for archiving corporate information, allows a perpetrator to bypass the authentication process.

The vulnerability of the TLS protocol verification component in HashiCorp’s Vault and Vault Enterprise archiving platforms relates to improper handling of exceptional states. Exploiting this vulnerability can allow attackers to bypass authentication processes...

CVE-2024-3545

CVE-2024-3545 involves Devolutions Remote Desktop Manager (Windows) version 2024.1.20 and earlier, and Devolutions Server version 2024.1.8 and earlier. The vulnerability stems from improper permission handling in the vault offline cache feature, which could allow an attacker with access to the in...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada Inc. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager version 2024.1.20 and earlier, which stems from improper handling of permissions in the vaul...

GHSA-RHH4-RH7C-7R5V vulnerabilities

Vulnerabilities for packages: wolfictl, terragrunt, kubescape, filebrowser, k9s, nuclei, zarf, kots...

CVE-2024-0406 vulnerabilities

Vulnerabilities for packages: wolfictl, terragrunt, kubescape, filebrowser, k9s, nuclei, zarf, kots...

CVE-2024-0406 vulnerabilities

Vulnerabilities for packages: terragrunt, wolfictl, nuclei, mattermost-fips, kots, filebrowser, k9s, gotenberg, zarf, chainctl, kubescape, vault...

Improper Certificate Validation

github.com/hashicorp/vault vulnerable to Improper Certificate Validation. The vulnerability exists due to inadequate validation during the TLS certificate authentication process, specifically in handling OCSP responses when one or more OCSP sources are configured...

CVE-2024-2660

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2660

CVE-2024-2660 : HashiCorp Vault and Vault Enterprise TLS cert authentication method did not correctly validate OCSP responses when multiple OCSP sources were configured, per the CVE entry. The issue affects Vault and Vault Enterprise 1.14.0 and newer and is fixed in Vault 1.16.0 and Vault Enterpr...