← Back

Hashicorp

hashicorp

193 CVEs • 21 products

Products (21)

Click to collapse
Toggle
Vault
vault
72 CVEs
Nomad
nomad
36 CVEs
Consul
consul
35 CVEs
Go Getter
go-getter
9 CVEs
Vagrant Vmware Fusion
vagrant_vmware_fusion
7 CVEs
Terraform
terraform
5 CVEs
Terraform Enterprise
terraform_enterprise
5 CVEs
Boundary
boundary
5 CVEs
Vagrant
vagrant
4 CVEs
Sentinel
sentinel
2 CVEs
Go Slug
go-slug
2 CVEs
Terraform Provider
terraform_provider
2 CVEs
Packer
packer
1 CVE
Vault Ssh Helper
vault-ssh-helper
1 CVE
Consul Docker Image
consul_docker_image
1 CVE
Vault Provider For Secrets Store Csi Driver
vault_provider_for_secrets_store_csi_driver
1 CVE
Vault Action
vault-action
1 CVE
Consul Template
consul_template
1 CVE
Retryablehttp
retryablehttp
1 CVE
Vagrant Vmware Utility
vagrant_vmware_utility
1 CVE
Hermes
hermes
1 CVE

CVEs (193)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-19653
1Hashicorp
1Consul
Nov 21, 2024
Dec 9, 2018
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not requir...Show more
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.Show less
CVE-2018-19786
1Hashicorp
1Vault
Nov 21, 2024
Dec 5, 2018
N/A· v4
8.1 HIGH· v3
4.3 MEDIUM· v2
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
CVE-2018-15869
1Hashicorp
1Packer
Nov 21, 2024
Aug 25, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may uni...Show more
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.Show less
CVE-2017-16873
1Hashicorp
1Vagrant Vmware Fusion
Nov 21, 2024
Mar 29, 2018
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges.
CVE-2017-16839
1Hashicorp
1Vagrant Vmware Fusion
Nov 21, 2024
Mar 29, 2018
N/A· v4
7.0 HIGH· v3
6.9 MEDIUM· v2
Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed.
CVE-2017-16512
1Hashicorp
1Vagrant Vmware Fusion
Nov 21, 2024
Mar 29, 2018
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available.
CVE-2018-9057
1Hashicorp
1Terraform
Jun 17, 2026
Mar 27, 2018
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obta...Show more
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.Show less
CVE-2017-16777
1Hashicorp
1Vagrant
May 13, 2026
Nov 16, 2017
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to esc...Show more
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.Show less
CVE-2017-16001
1Hashicorp
1Vagrant
May 13, 2026
Nov 6, 2017
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
CVE-2017-15884
1Hashicorp
1Vagrant Vmware Fusion
May 13, 2026
Oct 31, 2017
N/A· v4
7.0 HIGH· v3
6.9 MEDIUM· v2
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
CVE-2017-12579
1Hashicorp
1Vagrant Vmware Fusion
May 13, 2026
Oct 19, 2017
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell.
CVE-2017-11741
1Hashicorp
1Vagrant Vmware Fusion
May 13, 2026
Aug 8, 2017
N/A· v4
8.8 HIGH· v3
7.2 HIGH· v2
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of...Show more
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts.Show less
CVE-2017-7642
1Hashicorp
1Vagrant Vmware Fusion
May 13, 2026
Aug 2, 2017
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or sc...Show more
The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.Show less