Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
saltstack vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2015-4017
Salt prior to 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Saltstack Salt 2014.7.5
7.5
CVSSv2
CVE-2017-12791
Directory traversal vulnerability in minion id validation in SaltStack Salt prior to 2016.11.7 and 2017.7.x prior to 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
Saltstack Salt 2017.7.0
Saltstack Salt
5
CVSSv2
CVE-2015-6941
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x prior to 2015.5.6, and 2015.8.x prior to 2015.8.1 leak password information in debug logs.
Saltstack Salt 2015 8.0
Saltstack Salt 2015 5.0
Saltstack Salt 2015 5.5
Saltstack Salt 2015 5.2
Saltstack Salt 2015 5.4
Saltstack Salt 2015 5.1
Saltstack Salt 2015 5.3
2.1
CVSSv2
CVE-2017-8109
The salt-ssh minion code in SaltStack Salt 2016.11 prior to 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Saltstack Salt 2016.11.2
Saltstack Salt 2016.11.0
Saltstack Salt 2016.11
Saltstack Salt 2016.11.1
Saltstack Salt 2016.11.3
4.6
CVSSv2
CVE-2015-1839
modules/chef.py in SaltStack prior to 2014.7.4 does not properly handle files in /tmp.
Saltstack Salt
Fedoraproject Fedora 23
4.6
CVSSv2
CVE-2015-1838
modules/serverdensity_device.py in SaltStack prior to 2014.7.4 does not properly handle files in /tmp.
Saltstack Salt
Fedoraproject Fedora 23
4.3
CVSSv2
CVE-2016-3176
Salt prior to 2015.5.10 and 2015.8.x prior to 2015.8.8, when PAM external authentication is enabled, allows malicious users to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
Saltstack Salt 2015.8.7
Saltstack Salt 2015.8.5
Saltstack Salt 2015.8.4
Saltstack Salt 2015.8.3
Saltstack Salt 2015.8.1
Saltstack Salt
Saltstack Salt 2015.8.2
Saltstack Salt 2015.8.0
2.1
CVSSv2
CVE-2015-8034
The state.sls function in Salt prior to 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Saltstack Salt
6.8
CVSSv2
CVE-2016-1866
Salt 2015.8.x prior to 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle malicious users to execute arbitrary code by inserting packets into the minion-master data stream.
Saltstack Salt 2015.8.3
Saltstack Salt 2015.8.1
Saltstack Salt 2015.8.2
Saltstack Salt 2015.8.0
Opensuse Leap 42.1
7.2
CVSSv2
CVE-2014-3563
Multiple unspecified vulnerabilities in Salt (aka SaltStack) prior to 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Saltstack Salt
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654
CVE-2024-2757
authentication bypass
CVE-2024-3194
CVE-2024-33640
CVE-2024-21111
dos
insecure direct object reference
CVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »