3590 matches found
Upgraded Q -> 2 from #300 [1699029650174]
Judge has assessed an item in Issue 300 as 2 risk. The relevant finding follows: L-01 transferSAFEOwnership does not reset users allowed to modify a safe on behalf of an owner transferSAFEOwnership is not deleting potential allowed users in safeCan upon transferring a safe ownership. This could...
Vault, Consul, and Boundary Affected By HTTP/2 “Rapid Reset” Denial of Service Vulnerability (CVE-2023-44487)
Summary A denial of service vulnerability was identified in many implementations of the HTTP/2 protocol CVE-2023-44487, including Go’s implementation CVE-2023-39325. This was addressed by updating vulnerable components for the affected HashiCorp products listed above. Background In October 2023, ...
Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in access to client vault credentials (CVE-2023-45189).
Summary A vulnerability in IBM Robotic Process Automation may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. Vulnerability Details CVEID: CVE-2023-45189 DESCRIPTION: A...
Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.6 release and security update
An update is now available for Red Hat JBoss Web Server 5.7.6 on Red Hat Enterprise Linux versions 7, 8, and 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.6 release and security update
Red Hat JBoss Web Server 5.7.6 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVS...
CVE-2023-41096 Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devices
Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM SecureVault High modules allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier...
CVE-2023-41095 Keys Stored in Plaintext on Secure Vault High for Silabs OpenThread devices
Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM SecureVault High modules allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: conftest-fips, terraform-provider-sendgrid-fips, kubernetes-csi-livenessprobe-fips, plutono-fips, kubeflow, kubeflow-fips, falcoctl-fips, cortex, kubernetes-csi-livenessprobe, spark-operator, dynamic-localpv-provisioner-fips, up, prometheus-stackdriver-exporter,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: slsa-verifier, kubescape, dgraph, scorecard, terraform-provider-sendgrid, up, spark-operator, k3d, kubeflow, src, buildkitd, cortex, kubevela, aactl...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: ollama, nodetaint, terraform-provider-sendgrid-fips, kubernetes-dns-node-cache, aws-load-balancer-controller-fips, k3s, cosign, kube-logging-operator, frp, prometheus-stackdriver-exporter, timoni, stakater-reloader, vault-k8s-fips, metrics-server-fips,...
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: ollama, nodetaint, terraform-provider-sendgrid-fips, kubernetes-dns-node-cache, aws-load-balancer-controller-fips, k3s, cosign, kube-logging-operator, frp, prometheus-stackdriver-exporter, timoni, stakater-reloader, vault-k8s-fips, metrics-server-fips,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: slsa-verifier, mc, nri-prometheus, memcached-exporter, minio, gomplate, nginx-mainline, git-lfs, flux-helm-controller, bom, oauth2-proxy, sigstore-scaffolding, dex, gobuster, frp, spark-operator, prometheus-adapter, hey, weaviate, grpcurl, pulumi-kubernetes-operator,...
CVE-2023-4061
A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system...
CVE-2023-5077
A flaw was found in HashiCorp Vault and Vault Enterprise. This issue could allow a remote authenticated attacker to bypass security restrictions, due to a flaw in the Google Cloud secrets engine when creating or updating rolesets. By sending a specially crafted request, an attacker could exploit...
CVE-2023-3775
A flaw was found in the Vault Enterprise. A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in a denial of service...
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
The Vault and Vault Enterprise "Vault" Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0...
GHSA-86C6-3G63-5W64 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
The Vault and Vault Enterprise "Vault" Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0...
CVE-2023-3775
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8...
CVE-2023-3775
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8...