Most recent entries from all

bdu:2025-06183

BIT-vault-2023-2121 — Vault’s KV Diff Viewer Allowed for HTML Injection

Affected: Bitnami: vault

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

EUVD-2026-209187

fkie_cve-2023-2121

GHSA-gq98-53rq-qr5h — Hashicorp Vault vulnerable to Cross-site Scripting

Affected: Go: github.com/hashicorp/vault

gsd-2023-2121

RHSA-2023:6832 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.0 security, enhancement & bug fix update

lapack: Out-of-bounds read in *larrv golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding hashicorp: html injection into web ui Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration golang.org/x/net/html: Cross site scripting hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets golang: net/http, net/textproto: denial of service from excessive memory allocation golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of empty HTML attributes goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

WID-SEC-W-2023-1408 — Hashicorp Vault: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.