TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities

RISK EVALUATION TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs. 2. RECOMMENDED PRACTICES Upgrade to TopQuadrant TopBraid...

GO-2024-3113 Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault

Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault...

BIT-VAULT-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms for corporate information lies in improper validation or processing of exceptional conditions, allowing attackers to trigger service failures.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to the improper handling of requests originating from unauthorized IP addresses. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

GHSA-JJXF-26C9-77GM vulnerabilities

Vulnerabilities for packages: vault...

Vault Leaks Client Token and Token Accessor in Audit Devices

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

GHSA-JJXF-26C9-77GM Vault Leaks Client Token and Token Accessor in Audit Devices

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365 vulnerabilities

Vulnerabilities for packages: vault...

WordPress IP Vault – WP Firewall plugin <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass vulnerability

IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin IP Vault – WP Firewall versions = 1.1...

CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365

Vault Community Edition and Vault Enterprise regressed by removing the HMAC protection for sensitive headers in the audit device, causing plaintext client tokens and token accessors to be written to audit logs. The issue is documented as CVE-2024-8365 and has been fixed in Vault Community Edition...

CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

PT-2024-6383

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.17.5 HashiCorp Vault Enterprise versions prior to 1.17.5 and 1.16.9 Description The issue is related to the storage of client tokens and token accessors in plaintext in the audit log due to the removal of...

WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Bypass Vulnerability

Software IP Vault – WP Firewall Type Plugin Vulnerable versions = 1.1 Fixed in 2.1 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2022-4536 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 636ac61274e4 Credits rezaduty Required privilege...

ROS-20240902-14

Vulnerability of HashiCorp Vault and Vault Enterprise enterprise data archiving platforms is related to incorrect processing of requests coming from unauthorized IP addresses. Exploitation of the vulnerability could allow a remote attacker to cause a denial of service...

HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

CVE-2022-4536

The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...