3380 matches found
EUVD-2025-202450
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials...
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
GHSA-3FM2-HX3H-XM4V Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
CVE-2025-67642
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
CVE-2025-67642
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
CVE-2025-67642
The CVE-2025-67642 affects the Jenkins HashiCorp Vault Plugin versions 371.v884a_4dd60fb_6 and earlier. Root cause: the plugin does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials t...
CVE-2025-67642
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
CVE-2025-67642
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
CVE-2025-67642
Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...
PT-2025-50360
Name of the Vulnerable Software and Affected Versions Jenkins HashiCorp Vault Plugin versions 371.v884a 4dd60fb 6 and earlier Description The Jenkins HashiCorp Vault Plugin does not properly configure the context for Vault credential lookups. This can allow attackers who have Item/Configure...
Jenkins HashiCorp Vault Plugin 安全漏洞
Jenkins HashiCorp Vault Plugin is an open source plugin for Jenkins. A security vulnerability exists in Jenkins Plugin HashiCorp Vault 371.v884a4dd60fb6 and prior versions, which stems from a failure to set up the proper Vault credential lookup context, which could result in access to unauthorize...
Jenkins plugins Multiple Vulnerabilities (2025-12-10)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Coverage Plugin 2.3054.ve1ff7baa123b and earlier does not validate the configured coverage results ID when creating coverage result...
CVE-2025-61727 vulnerabilities
Vulnerabilities for packages: mockery, cloud-provider-aws-fips, mongodb-kubernetes-operator, whereabouts-fips, tigera-operator, configmap-reload-fips, argo-cd-fips, aws-efs-csi-driver-fips, trillian-fips, portieris-fips, k9s, prometheus-statsd-exporter-fips, flux-image-automation-controller-fips,...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: mockery, cloud-provider-aws-fips, mongodb-kubernetes-operator, whereabouts-fips, tigera-operator, configmap-reload-fips, argo-cd-fips, aws-efs-csi-driver-fips, trillian-fips, portieris-fips, k9s, prometheus-statsd-exporter-fips, flux-image-automation-controller-fips,...
ROS-20251128-03
A vulnerability in the Vault access control system and Vault enterprise information archiving platform Enterprise is related to authentication bypass using an alternate path or channel in AWS authentication method. AWS authentication method. Exploitation of the vulnerability could allow an attack...
GO-2025-4152 Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault
Vault’s Terraform Provider incorrectly set default denynullbind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
ROS-20251125-05
A vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms is related to authentication bypass using an alternate path or channel in AWS authentication method AWS authentication method. Exploitation of the vulnerability could allow an attacker acting...
This Week in Spring - Spring Boot 4 edition! - November 25th, 2025
Hi, Spring fans! Welcome to another illustrious installment of This Week in Spring! It’s Thanksgiving week here in the United States. Thanksgiving is traditionally celebrated with friends and family every fourth Thursday of November, gathered around a table full of food and, usually, a giant...
CVE-2025-13357
Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. Thi...