Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 83

Export CSV
CVE-2020-10660

vault: Entity's Group membership inadvertently include Groups the Entity no longer has permissions to

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault
CVE-2018-19786

vault: writes the master key to the server log

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault
CVE-2024-8365

Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault