PT-2024-22569 · Hashicorp · Vault Enterprise

Name of the Vulnerable Software and Affected Versions: Vault Enterprise versions prior to 1.15.8 Description: The issue arises when Vault Enterprise is configured with performance standby nodes and a configured audit device, causing it to inadvertently log request headers on the standby node. The...

The vulnerability in the TLS certificate verification component of HashiCorp Vault and Vault Enterprise, a platform for archiving corporate information, allows a perpetrator to bypass the authentication process.

The vulnerability of the TLS protocol verification component in HashiCorp’s Vault and Vault Enterprise archiving platforms relates to improper handling of exceptional states. Exploiting this vulnerability can allow attackers to bypass authentication processes...

CVE-2024-3545

CVE-2024-3545 involves Devolutions Remote Desktop Manager (Windows) version 2024.1.20 and earlier, and Devolutions Server version 2024.1.8 and earlier. The vulnerability stems from improper permission handling in the vault offline cache feature, which could allow an attacker with access to the in...

Devolutions Remote Desktop Manager 安全漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada Inc. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager version 2024.1.20 and earlier, which stems from improper handling of permissions in the vaul...

GHSA-RHH4-RH7C-7R5V vulnerabilities

Vulnerabilities for packages: k9s, nuclei, kots, zarf, wolfictl, kubescape, filebrowser, terragrunt...

CVE-2024-0406 vulnerabilities

Vulnerabilities for packages: k9s, nuclei, kots, zarf, wolfictl, kubescape, filebrowser, terragrunt...

CVE-2024-0406 vulnerabilities

Vulnerabilities for packages: k9s, zarf, wolfictl, vault, chainctl, nuclei, mattermost-fips, kubescape, kots, terragrunt, gotenberg, filebrowser...

Improper Certificate Validation

github.com/hashicorp/vault vulnerable to Improper Certificate Validation. The vulnerability exists due to inadequate validation during the TLS certificate authentication process, specifically in handling OCSP responses when one or more OCSP sources are configured...

CVE-2024-2660

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2660

CVE-2024-2660 : HashiCorp Vault and Vault Enterprise TLS cert authentication method did not correctly validate OCSP responses when multiple OCSP sources were configured, per the CVE entry. The issue affects Vault and Vault Enterprise 1.14.0 and newer and is fixed in Vault 1.16.0 and Vault Enterpr...

CVE-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

CVE-2024-2660 Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7...

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Summary Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1...

PT-2024-2960 · Hashicorp +1 · Vault Enterprise +2

Name of the Vulnerable Software and Affected Versions: Vault versions 1.14.0 through 1.15.6 Vault Enterprise versions 1.14.0 through 1.14.10 and 1.15.0 through 1.15.6 Description: The issue is related to the incorrect validation of OCSP responses when one or more OCSP sources are configured in th...

HashiCorp Vault和HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault and HashiCorp Vault Enterprise are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault is a private key access management tool.HashiCorp Vault Enterprise is an enterprise information archiving platform. A security vulnerability exists in HashiCorp Vault and HashiCorp...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.5.0 Vulnerability Details CVEID:CVE-2023-5764 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary code on the system, caused by a template injection flaw. By sending a specially...

CVE-2024-2921

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions...

CVE-2024-2921

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions...

CVE-2024-2921

The CVE concerns Devolutions Server (version family up to 2024.1.10.0) with an improper access control flaw in PAM vault permissions. An authenticated user who can access the PAM may reach unauthorized PAM entries due to the misconfigured permissions. Documents consistently describe the affected ...