Salt allows deleted minions to read or write to minions with the same id

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

GHSA-HVMJ-356C-GPF4 Salt allows deleted minions to read or write to minions with the same id

Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...

GHSA-6PRW-8XHM-H247 Salt uses weak permissions on the cache data

The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file...

Salt uses weak permissions on the cache data

The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file...

GHSA-XCX4-5WQ7-G5G7 SaltStack Salt Information Exposure

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

SaltStack Salt Information Exposure

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

salt password information leaked in debug logs

winuseradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs...

GHSA-CXM4-7QCW-267R salt password information leaked in debug logs

winuseradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs...

SaltStack Salt Directory traversal vulnerability in minion id validation

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID...

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

salt leaks git usernames and passwords to the log

salt before 2015.5.5 leaks git usernames and passwords to the log...

GHSA-Q2X6-8GFJ-HJXW salt leaks git usernames and passwords to the log

salt before 2015.5.5 leaks git usernames and passwords to the log...

CVE-2022-22976: BCrypt skips salt rounds for work factor of 31

Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22976: BCrypt skips salt rounds for work factor of 31. Please update as soon as possible...

Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework

cve-2021-38314 - Unauthenticated Sensitive Information Disclos...

Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

GHSA-8J9G-C9RP-JVG4 Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

Salt Improper Access Control

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

GHSA-VQH4-CRJF-JJXX Salt Improper Access Control

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

Subrion CMS PHP Object Injection

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...

GHSA-4J79-4M6Q-77VF Subrion CMS PHP Object Injection

includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request...