SaltStack Salt Directory Traversal vulnerability in salt-api

Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server...

GHSA-JX34-PPPM-GJVR SaltStack Salt Directory Traversal vulnerability in salt-api

Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server...

SUSE-SU-2022:1536-1 Security Beta update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 bsc1198556 - Fixes for Python 3.10 - Fix salt-ssh opts poisoning...

SUSE-SU-2022:1514-1 Security Beta update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 bsc1198556 - Fixes for Python 3.10 - Fix salt-ssh opts poisoning...

SUSE-RU-2022:1392-1 Recommended update for salt

This update for salt fixes the following issues: - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil bsc1197533 - Prevent data pollution between actions processed at the same time bsc1197637 - Fix salt-ssh opts poisoning bsc1197637 - Clear network...

SUSE-RU-2022:1391-1 Recommended update for salt

This update for salt fixes the following issues: - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil bsc1197533 - Prevent data pollution between actions processed at the same time bsc1197637 - Fix salt-ssh opts poisoning. bsc1197637 - Clear network...

SUSE-RU-2022:1389-1 Recommended update for salt

This update for salt fixes the following issues: - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil bsc1197533 - Prevent data pollution between actions processed at the same time bsc1197637 - Fix salt-ssh opts poisoning bsc1197637 - Clear network...

SUSE-RU-2022:1385-1 Recommended update for Salt

This update fixes the following issues: salt: - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil bsc1197533 - Prevent data pollution between actions processed at the same time bsc1197637 - Fix salt-ssh opts poisoning bsc1197637 - Remove duplicated metho...

SUSE-RU-2022:1384-1 Recommended update for Salt

This update fixes the following issues: salt: - Clear network interfaces cache on grains request bsc1196050 - Handle old qemu-img not supporting -U parameter bsc1195221 - Restrict 'state.orchestratesingle' to pass a pillar value if it exists bsc1194632 - Fix sparse disk errors on Python 2 virt...

salt-earth.org Cross Site Scripting vulnerability OBB-2555690

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts

A server-side request forgery SSRF flaw in an API of a large financial technology fintech platform potentially could have compromised millions of bank customers, allowing attackers to defraud clients by controlling their bank accounts and funds, researchers have found. A team at Salt Security’s...

CVE-2021-26113

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

CVE-2021-26113

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

CVE-2021-26113

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

Default credentials

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

CVE-2021-26113

CVE-2021-26113 affects Fortinet FortiWAN prior to 4.5.9. The issue is a vulnerability in the password hashing process: a one‑way hash is used with a predictable salt (CWE-760). If an attacker has obtained the password file, they may be able to guess stored passwords. No exploitation details are p...

CVE-2021-26113

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

The vulnerability of configuration management systems and remote execution of operations like Salt, which involves exposing information in error-prone data areas, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of configuration management systems and remote execution of operations like Salt is related to the exposure of information in error-prone data areas. Exploiting this vulnerability allows a malicious actor to gain access to confidential data, compromise its integrity, and cause...

FortiWAN - Use of hardcoded salt for password hashing

A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...

SaltStack 3000 < 3002.8 / 3003 < 3003.4 / 3004 < 3004.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: - Salt Masters do not sign pillar data with the minion's public key, which can result in attackers substituting arbitrary pillar data. CVE-2022-22934 - Job...