CVE-2017-8109

Removed by vendor...

Information Disclosure

salt is vulnerable to information disclosure. The system allows a minion to access any file in the master system, meaning a malicious user can manipulate a minion to access sensitive data...

Man In The Middle (MitM)

Salt is vulnerable to man in the middle MitM attack in minion authentication. It does not check the integrity of the message sent back by the master. It is possible to intercept the communication between the minion and master and alter certain information...

Path Injection Via Minion Ids

Salt is vulnerable to path injection attacks via minion ids. Salt masters do not properly validate the id of a connecting minion. This can lead to an attacker uploading files to the master in arbitrary locations. In particular, this can be used to bypass the manual validation of new unknown...

CVE-2016-9639

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

CVE-2016-9639

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

PYSEC-2017-34

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

PYSEC-2016-23

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

Code injection

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

PYSEC-2016-23

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

UBUNTU-CVE-2016-1866

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

CVE-2016-1866

Removed by vendor...

Minion Dentist - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Minion Dentist published at the 'play' market has multiple vulnerabilities...

openSUSE Security Update : salt (openSUSE-2016-318)

This update for salt fixes the following issues : - CVE-2016-1866: Improper handling of clear messages on the minion remote code execution boo965403 The following bugs were fixed : - boo958350: Salt crashes on invalid UTF-8 in package data - boo959572: 'salt '' pkg.infoinstalled' causes exception...

PYSEC-2013-14

Salt aka SaltStack before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key...

UBUNTU-CVE-2013-4439

Salt aka SaltStack before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key...

Mozilla, Blackberry To Test Website Security Via Fuzzing

Mozilla and Blackberry have announced a new collaboration project; the two companies will begin working in tandem to more fully flesh out Peach – a free software fuzzing application first developed nearly a decade ago – for testing the security of web browsers. In a post on its company blog by...