https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:24:49 +0000 https://cve.radiocsirt.org/vuln/bit-vault-2023-3462 <p><strong>Affected:</strong> Bitnami: vault</p> <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> <p><strong>Affected:</strong> Bitnami: vault</p> <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> https://cve.radiocsirt.org/vuln/bit-vault-2023-3462 https://cve.radiocsirt.org/vuln/euvd-2026-196627 EUVD-2026-196627 https://cve.radiocsirt.org/vuln/euvd-2026-196627 https://cve.radiocsirt.org/vuln/fkie_cve-2023-3462 <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-3462 https://cve.radiocsirt.org/vuln/ghsa-9v3w-w2jh-4hff <p><strong>Affected:</strong> Go: github.com/hashicorp/vault</p> <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> <p><strong>Affected:</strong> Go: github.com/hashicorp/vault</p> <p>HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.</p> https://cve.radiocsirt.org/vuln/ghsa-9v3w-w2jh-4hff https://cve.radiocsirt.org/vuln/gsd-2023-3462 gsd-2023-3462 https://cve.radiocsirt.org/vuln/gsd-2023-3462 https://cve.radiocsirt.org/vuln/rhsa-2023:6832 <p>lapack: Out-of-bounds read in *larrv golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding hashicorp: html injection into web ui Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration golang.org/x/net/html: Cross site scripting hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets golang: net/http, net/textproto: denial of service from excessive memory allocation golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of empty HTML attributes goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)</p> <p>lapack: Out-of-bounds read in *larrv golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding hashicorp: html injection into web ui Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration golang.org/x/net/html: Cross site scripting hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets golang: net/http, net/textproto: denial of service from excessive memory allocation golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of empty HTML attributes goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)</p> https://cve.radiocsirt.org/vuln/rhsa-2023:6832 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1928 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1928