2422 matches found
Unauthorized Access
salt is vulnerable to unauthorized access through its minions. The vulnerability exists as the Vault minions are receiving master tokens, which can be used to access secrets, even without a matching access policy...
Arbitrary File Access Using A Symlink Attack
salt is vulnerable to arbitrary file access. The vulnerability is possible through a symlink attack which is introduced by the usage of os.tmpnam to generate temporary files...
CVE-2017-13701
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method...
Friday Squid Blogging: Squid Product Recall
Lidl is recalling two of its packaged squid products because of the presence of struvite salt crystals. The danger is unclear. The article says that struvite crystals "may be mistaken as glass fragments," which isn't actually dangerous. It also says: "As these salt crystals may cause injury, the...
thegoodlandlord.net XSS vulnerability
Open Bug Bounty ID: OBB-378659 Description| Value ---|--- Affected Website:| thegoodlandlord.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Denial Of Service (DoS)
salt is vulnerable to denial of service DoS attacks. The attacks can be triggered when a malicious user sends an authentication request with payload containing an id with a null byte...
Directory Traversal
salt is vulnerable to directory traversal attacks. The attack is possible because of an incomplete fix for CVE-2017-12791. A malicious user can include escape characters and path separators into credentials when authenticating to a master to traverse the filesystem...
SaltStack Salt Directory Traversal Vulnerability (CNVD-2017-35509)
SaltStack Salt aka SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions , able to manage tens of thousands of servers , with the ability to quickly complete t...
CVE-2017-14695
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an...
CVE-2017-14695
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an...
Directory traversal
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an...
CVE-2017-14695
CVE-2017-14695 is a SaltStack Salt directory traversal vulnerability in minion_id validation. It affects Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2, enabling remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. This iss...
CVE-2017-14695
Removed by vendor...
CVE-2017-14696
CVE-2017-14696 is a SaltStack denial-of-service vulnerability triggered by a crafted authentication request. Affected are Salt versions: 2016.3.x before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2. Public advisories (e.g., SUSE-SU-2017:3381-1) confirm the DoS impact and not...
openSUSE Security Update : salt (openSUSE-2017-1182)
Salt was updated to 2017.7.2 and also to fix various bugs and security issues. See https://docs.saltstack.com/en/develop/topics/releases/2017.7.2.html for full changelog. Security issues fixed : - CVE-2017-14695: A directory traversal during minion id validation was fixed. boo1062462 -...
openSUSE Security Update : salt (openSUSE-2017-1183)
Salt was updated to 2017.7.2 and also to fix various bugs and security issues. See the following resources for the full changelog: https://docs.saltstack.com/en/develop/topics/releases/2017.7.2.html https://docs.saltstack.com/en/develop/topics/releases/2017.7.1.html...
Information Disclosure
salt is vulnerable to information disclosure. The application logs user credentials when the git clone command is used, allowing a malicious user with access to logs to gain access to other user credentials...
SUSE SLES11 Security Update : salt (SUSE-SU-2017:2666-1)
This update for salt fixes one security issue and bugs. The following security issue has been fixed : - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID bsc1053955. The...
