HuntersHunters
Sign inStart free
All projects

Security context

What an agent needs to avoid regressing past fixes — and find the next bug in this project.

Vault
hashicorp/vault

Secrets management, encryption as a service.

Go · github.com/hashicorp/vault
110
Advisories
110
CVEs
Critical
Peak severity
72
With fix diff

Distribution

By severity

Critical
6
High
23
Medium
22
Low
4
Unrated
55

By weakness class

Other
87
Auth / Access Control
8
Information Disclosure
5
Denial of Service
4
Improper Validation
2
SSRF
1
Code Injection
1
Cross-site Scripting
1
SQL Injection
1

Every fixed vulnerability (110)

Critical6 fixed
CriticalHashicorp Vault has Code Execution Vulnerability via Plugin Configuration1y agoCriticalHashiCorp Vault Improper Privilege Management2y agoCriticalHashiCorp Vault vulnerable to incorrect metadata access3y agoCriticalToken leases could outlive their TTL in HashiCorp Vault4y agoCriticalHashiCorp Vault Incorrect Permission Assignment for Critical Resource4y agoCriticalHashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.05y ago
High23 fixed
HighHashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations4mo agoHighHashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization4mo agoHighHashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service4mo agoHighHashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON10mo agoHighHashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass10mo agoHighHashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads1y agoHighHashicorp Vault has Privilege Escalation Vulnerability1y agoHighHashicorp Vault vulnerable to denial of service through memory exhaustion1y agoHighVault Community Edition privilege escalation vulnerability1y agoHighVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default1y agoHighHashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions 2y agoHighIncorrect TLS certificate auth method in Vault2y agoHighImproper Authentication in HashiCorp Vault2y agoHighHashiCorp Vault Authentication bypass2y agoHighMemory exhaustion in HashiCorp Vault2y agoHighHashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability2y agoHighHashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability2y agoHighHashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation3y agoHighIncorrect Privilege Assignment in HashiCorp Vault4y agoHighAuthentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault5y agoHighImproper Resource Shutdown or Release in HashiCorp Vault5y agoHighInvalid session token expiration 5y agoHighInformation Disclosure in HashiCorp Vault5y ago
Medium22 fixed
MediumHashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS4mo agoMediumHashiCorp Vault ldap auth method may not have correctly enforced MFA1y agoMediumHashicorp Vault has Incorrect Validation for Non-CA Certificates1y agoMediumHashicorp Vault has Lockout Feature Authentication Bypass1y agoMediumHashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse 1y agoMediumHashicorp Vault has Login MFA Rate Limit Bypass Vulnerability1y agoMediumHashicorp Vault Community vulnerable to Incorrect Authorization1y agoMediumHashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information1y agoMediumVault Leaks Client Token and Token Accessor in Audit Devices1y agoMediumHashiCorpVault does not correctly validate OCSP responses2y agoMediumHashicorp Vault may expose sensitive log information2y agoMediumEnumeration of users in HashiCorp Vault2y agoMediumHashiCorp Vault Improper Privilege Management2y agoMediumHashiCorp Vault Improper Input Validation vulnerability2y agoMediumHashiCorp Vault and Vault Enterprise vulnerable to user enumeration3y agoMediumHashiCorp Vault's revocation list not respected3y agoMediumHashicorp Vault vulnerable to Cross-site Scripting3y agoMediumHashiCorp Vault's PKI mount vulnerable to denial of service3y agoMediumHashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File3y agoMediumHashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks3y agoMediumHashiCorp Vault improper configuration of multi factor authentication4y agoMediumImproper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault5y ago
Low4 fixed
LowHashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users1y agoLowVault Community Edition rekey and recovery key operations can cause denial of service1y agoLowHashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims2y agoLowHashicorp Vault Privilege Escalation Vulnerability4y ago
Unrated55 fixed
UnratedHashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault2mo agoUnratedHashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault2mo agoUnratedHashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault2mo agoUnratedHashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault2mo agoUnratedHashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault10mo agoUnratedHashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault10mo agoUnratedHashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault11mo agoUnratedHashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault1y agoUnratedHashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault1y agoUnratedHashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault1y agoUnratedHashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault1y agoUnratedHashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault1y agoUnratedHashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault1y agoUnratedHashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault1y agoUnratedHashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault1y agoUnratedVault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault1y agoUnratedHashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault1y agoUnratedHashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault1y agoUnratedHashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault1y agoUnratedVault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault1y agoUnratedVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault1y agoUnratedVault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault1y agoUnratedHashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault2y agoUnratedImproper Resource Shutdown or Release in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedAuthentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault2y agoUnratedInformation Disclosure in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Incorrect Permission Assignment for Critical Resource in github.com/hashicorp/vault2y agoUnratedHashicorp Vault Privilege Escalation Vulnerability in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault2y agoUnratedInvalid session token expiration in github.com/hashicorp/vault2y agoUnratedImproper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedIncorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault2y agoUnratedHashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault and Vault Enterprise vulnerable to user enumeration in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault's revocation list not respected in github.com/hashicorp/vault2y agoUnratedHashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault2y agoUnratedHashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault's PKI mount vulnerable to denial of service in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault2y agoUnratedHashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault2y agoUnratedHashiCorp Vault Authentication bypass in github.com/hashicorp/vault2y agoUnratedEnumeration of users in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedImproper Authentication in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedHashicorp Vault may expose sensitive log information in github.com/hashicorp/vault2y agoUnratedToken leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault2y agoUnratedHashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault2y agoUnratedAuthentication bypass in github.com/hashicorp/vault2y agoUnratedDenial of service via memory exhaustion in github.com/hashicorp/vault2y agoUnratedCache-timing attacks in Shamir's secret sharing in github.com/hashicorp/vault3y ago