CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-25594
https://notcve.org/view.php?id=CVE-2020-25594
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. HashiCorp Vault y Vault Enterprise permitieron la enumeración de rutas de montaje de Secrets Engine por medio de peticiones HTTP no autenticadas. Corregido en las versiones 1.6.2 y 1.5.7 • https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336 https://security.gentoo.org/glsa/202207-01 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3282
https://notcve.org/view.php?id=CVE-2021-3282
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2. HashiCorp Vault Enterprise versiones 1.6.0 y 1.6.1, permitieron que el comando del operador raft "remove-peer" sea ejecutado contra los secundarios de DR sin autenticación. Corregido en la versión 1.6.2 • https://discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337 https://security.gentoo.org/glsa/202207-01 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-3283
https://notcve.org/view.php?id=CVE-2021-3283
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3. HashiCorp Nomad y Nomad Enterprise versiones hasta 0.12.9, exec y los controladores de tareas de Java pueden acceder a los procesos asociados con otras tareas en el mismo nodo. Corregido en las versiones 0.12.10 y 1.0.3 • https://discuss.hashicorp.com/t/hcsec-2021-01-nomad-s-exec-and-java-task-drivers-did-not-isolate-processes/20332 •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8567 – Kubernetes Secrets Store CSI Driver plugin directory traversals
https://notcve.org/view.php?id=CVE-2020-8567
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods. Kubernetes Secrets Store CSI Driver Vault Plugin anterior a versión v0.0.6, Azure Plugin anterior a versión v0.0.10 y GCP Plugin anterior a versión v0.2.0, permiten a un atacante que puede crear objetos SecretProviderClass especialmente diseñados para escribir en rutas de archivo arbitrarias en el sistema de archivos host , incluyendo la biblioteca /var/lib/kubelet/pods • https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384 https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-24: Path Traversal: '../filedir' •
CVSS: 8.6EPSS: 1%CPEs: 7EXPL: 0CVE-2021-3121 – gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
https://notcve.org/view.php?id=CVE-2021-3121
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. Se detectó un problema en GoGo Protobuf versiones anteriores a 1.3.2. El archivo plugin/unmarshal/unmarshal.go carece de determinada comprobación de índice, también se conoce como el problema "skippy peanut butter" A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this vulnerability is to availability. • https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025 https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2 https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e%40%3Ccommits.pulsar.apache.org%3E https://lists.apache.org&#x • CWE-129: Improper Validation of Array Index •