92 matches found
Vulnerability fixed in Salt
A vulnerability has been fixed in Salt. A malicious person could vulnerability potentially exploit it to execute execute arbitrary code. To do this, the malicious party must have the ability to place a rogue file on a Salt monitored device. This file should then be passed through the Snapper modu...
The vulnerability of the configuration management system and remote execution of operations, related to the lack of measures to neutralize special elements, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of configuration management systems and remote execution of operations related to Salt is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to gain access to confidential data, compromise its integrity, and cau...
PYSEC-2021-891
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...
CVE-2021-25315
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...
UBUNTU-CVE-2021-25315
CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior t...
CVE-2021-25283
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...
CVE-2021-25283
A flaw was found in Salt. The jinja renderer does not protect against server-side template injection attacks. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
CVE-2021-25282
A flaw was found in salt. The salt.wheel.pillarroots.write method is vulnerable to directory traversal...
CVE-2019-18897
A flaw was found in salt. A UNIX Symbolic Link Symlink Following vulnerability in some implementations of Linux servers allows local attackers to escalate privileges from user salt to root...
CVE-2019-1010259
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.userchpass function from the MySQL module for Salt. The attack vector is: specially crafted...
CVE-2019-5615 Rapid7 InsightVM Stored Credential Exposure
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious user...
Arbitrary File Access Using A Symlink Attack
salt is vulnerable to arbitrary file access. The vulnerability is possible through a symlink attack which is introduced by the usage of os.tmpnam to generate temporary files...
Information Disclosure
salt is vulnerable to information disclosure. The application logs user credentials when the git clone command is used, allowing a malicious user with access to logs to gain access to other user credentials...
UBUNTU-CVE-2015-6918
salt before 2015.5.5 leaks git usernames and passwords to the log...
PYSEC-2017-70
salt before 2015.5.5 leaks git usernames and passwords to the log...
Information Disclosure
salt is vulnerable to an information disclosure vulnerability. The library mirrors the file permissions on the salt-master when setting up its temporary file location for the local cache. This can allow a malicious local user to access sensitive credentials...
Information Disclosure
salt is vulnerable to information disclosure. The system allows a minion to access any file in the master system, meaning a malicious user can manipulate a minion to access sensitive data...
Information Disclosure
salt is vulnerable to information disclosures. The library stores it secrets in a file called highstate.cache.p that is world readable, allowing a malicious user to access sensitive information...
SaltStack Salt Information Disclosure Vulnerability (CNVD-2017-01659)
Salt a.k.a. SaltStack is an open source set of tools for managing infrastructure from SaltStack, Inc. in the United States. A security vulnerability exists in versions of Salt prior to 2015.8.3 that stems from the program assigning weak permissions to cached data. A local attacker could exploit t...