Filtered by vendor Hashicorp
Subscriptions
Total
144 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-24359 | 1 Hashicorp | 1 Vault-ssh-helper | 2020-08-26 | 7.5 High |
| HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0. | ||||
| CVE-2019-9764 | 1 Hashicorp | 1 Consul | 2020-08-24 | N/A |
| HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4. | ||||
| CVE-2019-8336 | 1 Hashicorp | 1 Consul | 2020-08-24 | N/A |
| HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances. | ||||
| CVE-2019-12618 | 1 Hashicorp | 1 Nomad | 2020-08-24 | N/A |
| HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. | ||||
| CVE-2019-12291 | 1 Hashicorp | 1 Consul | 2020-08-24 | N/A |
| HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. | ||||
| CVE-2020-13170 | 1 Hashicorp | 1 Consul | 2020-06-17 | 7.5 High |
| HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. | ||||
| CVE-2020-12758 | 1 Hashicorp | 1 Consul | 2020-06-17 | 7.5 High |
| HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. | ||||
| CVE-2020-10944 | 1 Hashicorp | 1 Nomad | 2020-05-06 | 5.4 Medium |
| HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5. | ||||
| CVE-2020-10660 | 1 Hashicorp | 1 Vault | 2020-03-30 | 5.3 Medium |
| HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4. | ||||
| CVE-2020-10661 | 1 Hashicorp | 1 Vault | 2020-03-25 | 9.1 Critical |
| HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4. | ||||
| CVE-2019-19879 | 1 Hashicorp | 1 Sentinel | 2020-02-25 | 7.5 High |
| HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. | ||||
| CVE-2020-7956 | 1 Hashicorp | 1 Nomad | 2020-02-04 | 9.8 Critical |
| HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3. | ||||
| CVE-2017-16512 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | N/A |
| The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available. | ||||
| CVE-2018-15869 | 1 Hashicorp | 1 Packer | 2019-10-03 | N/A |
| An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog. | ||||
| CVE-2017-16777 | 1 Hashicorp | 1 Vagrant | 2019-10-03 | N/A |
| If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root. | ||||
| CVE-2017-16839 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | N/A |
| Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed. | ||||
| CVE-2017-15884 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | N/A |
| In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges. | ||||
| CVE-2017-12579 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | N/A |
| An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell. | ||||
| CVE-2017-11741 | 1 Hashicorp | 1 Vagrant Vmware Fusion | 2019-10-03 | N/A |
| HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts. | ||||
| CVE-2017-16001 | 1 Hashicorp | 1 Vagrant | 2019-10-03 | N/A |
| In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges. | ||||