Show filters
48 Total Results
Displaying 31-40 of 48
Sort by:
Attacker Value
Unknown
CVE-2022-24684
Disclosure Date: February 15, 2022 (last updated October 07, 2023)
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6.
0
Attacker Value
Unknown
CVE-2022-24686
Disclosure Date: February 14, 2022 (last updated February 23, 2025)
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
0
Attacker Value
Unknown
CVE-2021-43415
Disclosure Date: December 03, 2021 (last updated February 23, 2025)
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
0
Attacker Value
Unknown
CVE-2021-41865
Disclosure Date: October 07, 2021 (last updated November 28, 2024)
HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.
0
Attacker Value
Unknown
CVE-2021-37218
Disclosure Date: September 07, 2021 (last updated February 23, 2025)
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
0
Attacker Value
Unknown
CVE-2021-21681
Disclosure Date: August 31, 2021 (last updated February 23, 2025)
Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
0
Attacker Value
Unknown
CVE-2021-32575
Disclosure Date: June 17, 2021 (last updated November 28, 2024)
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
0
Attacker Value
Unknown
CVE-2021-3283
Disclosure Date: February 01, 2021 (last updated November 28, 2024)
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
0
Attacker Value
Unknown
CVE-2020-28348
Disclosure Date: November 24, 2020 (last updated February 22, 2025)
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
0
Attacker Value
Unknown
CVE-2020-27195
Disclosure Date: October 22, 2020 (last updated November 28, 2024)
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
0
