Cross-site Scripting (XSS)

github.com/hashicorp/consul is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the server's failure to explicitly set a Content-Type HTTP header in the response, allowing user-provided inputs to be misinterpreted, which can lead to reflected XSS attacks...

Brute Force Attacks

github.com/hashicorp/consul is vulnerable to brute force attacks. Consul responds with a 403 when trying to destroy an invalid access token but a 404 when trying to clone an invalid token. Using this flaw an attacker can brute force a valid access token by logging the 403 forbidden responses...