PT-2021-22206 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.8.0 HashiCorp Vault and Vault Enterprise versions 1.7.x prior to 1.7.4 HashiCorp Vault and Vault Enterprise versions 1.6.x prior to 1.6.6 Description: The UI of HashiCorp Vault and Vaul...

Hashicorp HashiCorp Vault 信息泄露漏洞

HashiCorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp, USA. An information disclosure vulnerability exists in HashiCorp Vault, which stems from a misconfiguration of the product's cache that causes the browser to incorrectly cache sensitive information about a...

Hashicorp HashiCorp Vault 安全特征问题漏洞

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. HashiCorp Vault suffers from a security signature issue vulnerability that arises from the product not adding valid access permissions to an underlying database file. An attacker could use this...

Vault’s Integrated Storage Backend Database File May Have Excessively Broad Permissions

Summary When initializing Vault’s Integrated Storage backend, excessively broad filesystem permissions may be set for the underlying Bolt database used by Vault’s Raft implementation. This vulnerability, CVE-2021-38553, was fixed in Vault 1.8.0. Background Vault’s Integrated Storage was introduce...

Vault’s UI Cached User-Viewed Secrets Between Shared Browser Sessions

Summary The Vault UI erroneously cached and exposed user-viewed secrets between authenticated sessions in a single shared browser, if the browser window / tab was not refreshed or closed between logout and a subsequent login. This vulnerability, CVE-2021-38554, was fixed in Vault 1.8.0 and will b...

GHSA-FP52-QW33-MFMW Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...

Information Disclosure

github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability exists due to a failure to revoke dynamic secrets for a mount in a deleted namespace...

Improper Resource Shutdown or Release in HashiCorp Vault

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2...

GHSA-9VH5-R4QW-V3VV Improper Resource Shutdown or Release in HashiCorp Vault

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2...

Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple Oracle database server security vulnerabilities affect IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2021-2245 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database - Enterprise Edition Unified Audit component could allow an...

Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform

Summary Multiple Oracle Database server security vulnerabilities affect IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2021-2245 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database - Enterprise Edition Unified Audit...

CVE-2021-2326

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

CVE-2021-2326

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

CVE-2021-2326

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

Design/Logic Flaw

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

Oracle Database Server Unauthorized Access Vulnerability (CNVD-2021-57455)

Oracle Database Server is an object-a relational database management system that provides an open, comprehensive, and integrated approach to information management. A security vulnerability exists in the Database Vault component of Oracle Database Server version 12.2.0.1, 19c. An attacker could...

CVE-2021-2326

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Database Vault. Successful...

CVE-2021-2326

CVE-2021-2326 concerns Oracle Database Server Database Vault. Affected: Database Vault within Oracle Database Server versions 12.2.0.1 and 19c. Vulnerability allows a high-privilege attacker with DBA privileges and network access via Oracle Net to read data from Database Vault. Root cause and exa...

Oracle Database Server 输入验证错误漏洞

Oracle Database Server is an object-a relational database management system that provides an open, comprehensive, and integrated approach to information management. A security vulnerability exists in the Database Vault component of Oracle Database Server version 12.2.0.1, 19c. An attacker could...

Authorization Bypass

wildfly-controller is vulnerable to authorization bypass. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possib...