Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
saltstack salt vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2015-6941
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x prior to 2015.5.6, and 2015.8.x prior to 2015.8.1 leak password information in debug logs.
Saltstack Salt 2015 8.0
Saltstack Salt 2015 5.0
Saltstack Salt 2015 5.5
Saltstack Salt 2015 5.2
Saltstack Salt 2015 5.4
Saltstack Salt 2015 5.1
Saltstack Salt 2015 5.3
7.8
CVSSv3
CVE-2017-8109
The salt-ssh minion code in SaltStack Salt 2016.11 prior to 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Saltstack Salt 2016.11.2
Saltstack Salt 2016.11.0
Saltstack Salt 2016.11
Saltstack Salt 2016.11.1
Saltstack Salt 2016.11.3
5.3
CVSSv3
CVE-2015-1839
modules/chef.py in SaltStack prior to 2014.7.4 does not properly handle files in /tmp.
Saltstack Salt
Fedoraproject Fedora 23
5.3
CVSSv3
CVE-2015-1838
modules/serverdensity_device.py in SaltStack prior to 2014.7.4 does not properly handle files in /tmp.
Saltstack Salt
Fedoraproject Fedora 23
5.6
CVSSv3
CVE-2016-3176
Salt prior to 2015.5.10 and 2015.8.x prior to 2015.8.8, when PAM external authentication is enabled, allows malicious users to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
Saltstack Salt 2015.8.7
Saltstack Salt 2015.8.5
Saltstack Salt 2015.8.4
Saltstack Salt 2015.8.3
Saltstack Salt 2015.8.1
Saltstack Salt
Saltstack Salt 2015.8.2
Saltstack Salt 2015.8.0
3.3
CVSSv3
CVE-2015-8034
The state.sls function in Salt prior to 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
Saltstack Salt
8.1
CVSSv3
CVE-2016-1866
Salt 2015.8.x prior to 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle malicious users to execute arbitrary code by inserting packets into the minion-master data stream.
Saltstack Salt 2015.8.3
Saltstack Salt 2015.8.1
Saltstack Salt 2015.8.2
Saltstack Salt 2015.8.0
Opensuse Leap 42.1
NA
CVE-2014-3563
Multiple unspecified vulnerabilities in Salt (aka SaltStack) prior to 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Saltstack Salt
NA
CVE-2013-4435
Salt (aka SaltStack) 0.15.0 up to and including 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Saltstack Salt 0.15.0
Saltstack Salt 0.15.1
Saltstack Salt 0.17.0
Saltstack Salt 0.16.0
Saltstack Salt 0.16.3
Saltstack Salt 0.16.2
Saltstack Salt 0.16.4
NA
CVE-2013-4436
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote malicious users to have unspecified impact via a man-in-the-middle (MITM) attack.
Saltstack Salt 0.17.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
authentication bypass
CVE-2024-30051
remote
CVE-2024-27954
CVE-2023-51483
CVE-2023-47782
SSRF
CVE-2024-24715
CVE-2023-52424
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »