Missing Authorization

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Incorrect Permission Assignment for Critical Resource

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

UBUNTU-CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

CVE-2025-22239 CVE-2025-22239 salt advisory

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22236 CVE-2025-22236 salt advisory

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

CVE-2025-22236

CVE-2025-22236 concerns Salt minion: an attacker with a minion key could craft a message to trigger a job on other minions via the minion event bus authorization bypass. Technical details in connected sources show this affects Salt Minion components (v3xxx series with 3007.0+ listed as affected) ...

CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from an authorized minion that can inject arbitrary events into the main event bus...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from an event bus authorization bypass that could lead an attacker to execute jobs on other minions...

CVE-2025-22239: Improper Authorization

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22236: Improper Authentication

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

PT-2025-25394

Name of the Vulnerable Software and Affected Versions Salt Master affected versions not specified Description The issue allows arbitrary event injection on the Salt Master. An authorized minion can use the master's minion event method to send arbitrary events onto the master's event bus...

PT-2025-25391

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 3007.0 and later Description The issue concerns an authorization bypass in the Minion event bus. An attacker with access to a minion key can craft a message to potentially execute a job on other minions. Recommendations...

MAL-2024-2342 Malicious code in event-bus (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-1372 Malicious code in @ozon-ob-foundation/event-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5d1a30ed3380955e93d6ee25ac05fd6a61c06bc20d670f0fd01e6a4565c82e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

This Week in Spring - January 2nd, 2024

Hi, Spring fans! Happy New Year! As we step into 2024, full of hope and enthusiasm, welcome to the first installment of This Week in Spring. It's a time for new beginnings and resolutions, and what better way to start than by exploring the ever-evolving world of Spring? I hope your new year...