Vulnerabilities > Hashicorp > Vault
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-02-01 | CVE-2024-0831 | Information Exposure Through Log Files vulnerability in Hashicorp Vault 1.15.0/1.15.2 Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`. | 6.5 |
| 2023-12-08 | CVE-2023-6337 | Allocation of Resources Without Limits or Throttling vulnerability in Hashicorp Vault HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. | 7.5 |
| 2023-11-09 | CVE-2023-5954 | Memory Leak vulnerability in Hashicorp Vault HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. | 7.5 |
| 2023-09-29 | CVE-2023-3775 | Unspecified vulnerability in Hashicorp Vault A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. | 4.9 |
| 2023-09-29 | CVE-2023-5077 | Incorrect Permission Assignment for Critical Resource vulnerability in Hashicorp Vault The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. | 7.5 |
| 2023-09-15 | CVE-2023-4680 | Improper Input Validation vulnerability in Hashicorp Vault HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. | 6.8 |
| 2023-07-31 | CVE-2023-3462 | Information Exposure Through Discrepancy vulnerability in Hashicorp Vault 1.13.0/1.13.4/1.14.0 HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. | 5.3 |
| 2023-07-28 | CVE-2023-3774 | Improper Handling of Exceptional Conditions vulnerability in Hashicorp Vault 1.12.8/1.13.4/1.14.0 An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. | 4.9 |
| 2023-06-09 | CVE-2023-2121 | Cross-site Scripting vulnerability in Hashicorp Vault Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. | 5.4 |
| 2023-05-01 | CVE-2023-2197 | Inadequate Encryption Strength vulnerability in Hashicorp Vault HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. | 2.5 |