CVE-2020-2313

A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2020-2313

Summary: CVE-2020-2313 affects the Jenkins Azure Key Vault Plugin (versions 2.0 and earlier). The issue is a missing permission check on multiple HTTP endpoints, allowing attackers who have Overall/Read permission to enumerate credentials IDs stored in Jenkins. Impact (as stated): Credentials IDs...

PT-2020-15543 · Jenkins · Jenkins Azure Key Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure Key Vault Plugin versions 2.0 and earlier Description: A missing permission check in the Jenkins Azure Key Vault Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

The vulnerability of the Database Vault component of the Oracle Database Server system allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Database Vault component of the Oracle Database Server system exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality and integrity of the protected information through th...

Scammers are spoofing bank phone numbers to rob victims

It can be a very convincing trick… “You can check the number in your display online sir. You’ll see I’m really calling from your bank.” That is, of course, if you are unaware that phone numbers can be spoofed. Then again, they wouldn’t be successful scammers if they weren’t convincing. If you...

Oracle Database Server Vault component unauthorized access vulnerability

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. An unauthorized access vulnerability exists in the Oracle Database Server Database Vaul...

CVE-2020-14736

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Public Synonym privilege with network access via Oracle Net to compromi...

CVE-2020-14736

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Public Synonym privilege with network access via Oracle Net to compromi...

Design/Logic Flaw

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Public Synonym privilege with network access via Oracle Net to compromi...

CVE-2020-14736

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Public Synonym privilege with network access via Oracle Net to compromi...

CVE-2020-14736

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows high privileged attacker having Create Public Synonym privilege with network access via Oracle Net to compromi...

CVE-2020-14736

CVE-2020-14736 affects Oracle Database Server — Database Vault component. Affected versions: 11.2.0.4, 12.1.0.2, 12.2.0.1. The vulnerability enables a high privileged attacker with Create Public Synonym privilege and network access via Oracle Net to compromise Database Vault, potentially resultin...

Reconstruct Instead of Validating

Project Zero dropped a great bug in Vault which I think would have been prevented by one of the lessons learned of cryptography engineering: when you can, always prefer reconstructing a value rather than parsing and validating it. You should read the blog post to understand the attack first,...

Enter the Vault: Authentication Issues in HashiCorp Vault

Posted by Felix Wilhelm, Project Zero Introduction In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services AWS and Google Cloud Platform GCP. These issues can lead to an authentication bypass in configurations that use the aws and gcp aut...

CVE-2020-25816

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...

CVE-2020-25816

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...

Denial of service

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...

CVE-2020-25816

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...

CVE-2020-25816

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...

CVE-2020-25816

CVE-2020-25816 affects HashiCorp Vault and Vault Enterprise (1.0 and later). Root cause: batch token leases were not scheduled to expire, letting leases outlive their TTL. Consequence: batch token leases could persist beyond intended TTL, undermining expiration controls. Fixed in Vault 1.4.7 and ...