Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

saltstack salt 2016.11.2 vulnerabilities and exploits

(subscribe to this query)
187
VMScore
CVE-2017-8109
The salt-ssh minion code in SaltStack Salt 2016.11 prior to 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Saltstack Salt 2016.11.2Saltstack Salt 2016.11.0Saltstack Salt 2016.11Saltstack Salt 2016.11.1Saltstack Salt 2016.11.3
578
VMScore
CVE-2017-5192
When using the local_batch client from salt-api in SaltStack Salt prior to 2015.8.13, 2016.3.x prior to 2016.3.5, and 2016.11.x prior to 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.
Saltstack Salt 2016.3.3Saltstack SaltSaltstack Salt 2016.11.0Saltstack Salt 2016.11.1Saltstack Salt 2016.11.2Saltstack Salt 2016.3.0Saltstack Salt 2016.3.1Saltstack Salt 2016.3.2Saltstack Salt 2016.3.4
801
VMScore
CVE-2017-5200
Salt-api in SaltStack Salt prior to 2015.8.13, 2016.3.x prior to 2016.3.5, and 2016.11.x prior to 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.
Saltstack Salt 2016.11.0Saltstack Salt 2016.3.4Saltstack Salt 2016.11.2Saltstack Salt 2016.3.0Saltstack Salt 2016.3.1Saltstack Salt 2016.3.2Saltstack Salt 2016.11.1Saltstack Salt 2016.3.3Saltstack Salt
668
VMScore
CVE-2017-14695
Directory traversal vulnerability in minion id validation in SaltStack Salt prior to 2016.3.8, 2016.11.x prior to 2016.11.8, and 2017.7.x prior to 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerabili...
Saltstack Salt 2016.11.0Saltstack Salt 2016.11Saltstack SaltSaltstack Salt 2017.7.0Saltstack Salt 2016.11.2Saltstack Salt 2016.11.1Saltstack Salt 2016.11.7Saltstack Salt 2016.11.6Saltstack Salt 2016.11.5Saltstack Salt 2016.11.4Saltstack Salt 2017.7.1Saltstack Salt 2016.11.3
445
VMScore
CVE-2017-14696
SaltStack Salt prior to 2016.3.8, 2016.11.x prior to 2016.11.8, and 2017.7.x prior to 2017.7.2 allows remote malicious users to cause a denial of service via a crafted authentication request.
Saltstack SaltSaltstack Salt 2016.11Saltstack Salt 2016.11.0Saltstack Salt 2016.11.1Saltstack Salt 2016.11.2Saltstack Salt 2017.7.0Saltstack Salt 2016.11.4Saltstack Salt 2016.11.5Saltstack Salt 2016.11.6Saltstack Salt 2016.11.7Saltstack Salt 2016.11.3Saltstack Salt 2017.7.1
605
VMScore
CVE-2019-17361
In SaltStack Salt up to and including 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Saltstack SaltDebian Debian Linux 9.0Debian Debian Linux 10.0Opensuse Leap 15.1Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 16.04
672
VMScore
CVE-2020-11651
An issue exists in SaltStack Salt prior to 2019.2.4 and 3000 prior to 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user toke...
Saltstack SaltOpensuse Leap 15.1Debian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 16.04Vmware Application Remote Collector 8.0.0Vmware Application Remote Collector 7.5.0
360
VMScore
CVE-2020-11652
An issue exists in SaltStack Salt prior to 2019.2.4 and 3000 prior to 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Saltstack SaltOpensuse Leap 15.1Debian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 16.04Blackberry Workspaces Server 9.1.0Blackberry Workspaces ServerVmware Application Remote Collector 8.0.0Vmware Application Remote Collector 7.5.0
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4671unauthorizedCVE-2024-4776CVE-2024-3407CVE-2024-26026CVE-2024-32888wirelessCVE-2024-4656template injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook