CVE-2021-2175

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net ...

HashiCorp Terraform 安全漏洞

Hashicorp Terraform is an open source tool for provisioning and managing cloud infrastructure from HashiCorp Hashicorp, USA. A security vulnerability exists in HashiCorp Terraform versions prior to 2.19.1 that stems from a failure to properly configure the GCE type binding tag for Vault's GCP...

HashiCorp Vault 信任管理问题漏洞

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. A security vulnerability exists in HashiCorp Vault versions 1.5.1 and later that stems from an inability to validate TLS certificates...

Terraform’s Vault Provider Did Not Correctly Configure Bound Labels for GCP Auth

Summary Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. This vulnerability, CVE-2021-30476, was fixed in terraform-provider-vault 2.19.1. Background Terraform’s Vault Provider...

Vault’s Cassandra Integrations Did Not Validate TLS Certificates

Summary Vault and Vault Enterprise “Vault” Cassandra integrations, a Vault storage backend and database secrets engine plugin, did not validate TLS certificates when connecting to Cassandra clusters. This vulnerability, CVE-2021-27400, was fixed in Vault and Vault Enterprise 1.6.4 and 1.7.1...

Vault’s PKI Engine CRL May Exclude Revoked But Unexpired Certificates After Tidy

Summary Vault and Vault Enterprise “Vault” PKI Secrets Engine tidy functionality may cause Vault to exclude revoked-but-unexpired certificates from the Vault CRL. This vulnerability, CVE-2021-29653, was fixed in Vault and Vault Enterprise 1.5.8, 1.6.4, and 1.7.1. Background The Vault PKI Secrets...

Oracle Database Server Input Validation Error Vulnerability (CNVD-2021-33859)

Oracle Database Server is an object-one relational database management system that provides an open, comprehensive, and integrated approach to information management. A security vulnerability exists in the Database Vault component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19...

PT-2021-2874 · Oracle · Oracle Database Server +1

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c Description: The issue is related to the Database Vault component, where an easily exploitable vulnerability allows a high-privileged attacker with Create Any View, Select Any...

Oracle Database Server 输入验证错误漏洞

Oracle Database Server is an object-one relational database management system that provides an open, comprehensive, and integrated approach to information management. A security vulnerability exists in the Database Vault component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.2 Security Update

Updated Red Hat JBoss Web Server 5.4.2 packages are now available for Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

GHSA-VCG8-98Q8-G7MJ Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and t...

Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and t...

GHSA-77G3-3J5W-64W4 Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchiv...

CVE-2019-14885

A flaw was found in the JBoss EAP Vault system. Confidential information of the system property’s security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...

[SECURITY] Fedora 34 Update: plasma-vault-5.21.3-1.fc34

Plasma Vault allows to lock and encrypt sets of documents and hide them from prying eyes even when the user is logged in...

Fedora: Security Advisory for plasma-vault (FEDORA-2021-85c9774673)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management

Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-25816 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...

Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management

Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-16250 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...

Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management

Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-12757 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...

FreeBSD : vault -- unauthenticated license read (52bd2d59-4ab5-4bef-a599-7aac4e92238b)

vault developers report : Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...