https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:27:18 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-08718 bdu:2024-08718 https://cve.radiocsirt.org/vuln/bdu:2024-08718 https://cve.radiocsirt.org/vuln/bit-vault-2023-4680 <p><strong>Affected:</strong> Bitnami: vault</p> <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> <p><strong>Affected:</strong> Bitnami: vault</p> <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> https://cve.radiocsirt.org/vuln/bit-vault-2023-4680 https://cve.radiocsirt.org/vuln/euvd-2026-188934 EUVD-2026-188934 https://cve.radiocsirt.org/vuln/euvd-2026-188934 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4680 <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-4680 https://cve.radiocsirt.org/vuln/ghsa-v84f-6r39-cpfc <p><strong>Affected:</strong> Go: github.com/hashicorp/vault</p> <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> <p><strong>Affected:</strong> Go: github.com/hashicorp/vault</p> <p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p> https://cve.radiocsirt.org/vuln/ghsa-v84f-6r39-cpfc https://cve.radiocsirt.org/vuln/gsd-2023-4680 gsd-2023-4680 https://cve.radiocsirt.org/vuln/gsd-2023-4680 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2361 <p>Ein entfernter authentifizierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter authentifizierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2361