Filtered by vendor Saltstack
Subscribe
Total
53 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-17361 | 3 Debian, Opensuse, Saltstack | 3 Debian Linux, Leap, Salt | 2024-02-04 | 6.8 MEDIUM | 9.8 CRITICAL |
| In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. | |||||
| CVE-2019-1010259 | 1 Saltstack | 2 Salt 2018, Salt 2019 | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4. | |||||
| CVE-2018-15751 | 1 Saltstack | 1 Salt | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). | |||||
| CVE-2018-15750 | 1 Saltstack | 1 Salt | 2024-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. | |||||
| CVE-2017-7893 | 1 Saltstack | 1 Salt | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. | |||||
| CVE-2017-14695 | 1 Saltstack | 1 Salt | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791. | |||||
| CVE-2017-12791 | 1 Saltstack | 1 Salt | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. | |||||
| CVE-2015-6941 | 1 Saltstack | 1 Salt 2015 | 2024-02-04 | 5.0 MEDIUM | 9.8 CRITICAL |
| win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. | |||||
| CVE-2017-5200 | 1 Saltstack | 1 Salt | 2024-02-04 | 9.0 HIGH | 8.8 HIGH |
| Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. | |||||
| CVE-2017-5192 | 1 Saltstack | 1 Salt | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. | |||||
| CVE-2017-14696 | 1 Saltstack | 1 Salt | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request. | |||||
| CVE-2015-4017 | 1 Saltstack | 1 Salt | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. | |||||
| CVE-2015-6918 | 1 Saltstack | 1 Salt 2015 | 2024-02-04 | 3.5 LOW | 6.3 MEDIUM |
| salt before 2015.5.5 leaks git usernames and passwords to the log. | |||||