Weak Hash Algorithm Without Salt

dolibarr/dolibarr is vulnerable to using a weak hash algorithm without salt. The library does not encrypt its passwords with a salt, meaning that the password hash stored on the system can be easily brute forced...

Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses

=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Ris...

Insecure Random Number Generation

github.com/vmware/harbor uses math/rand to generate salt values. This is not cryptographically secure and makes it easier for attackers to brute force the value...

CVE-2017-8081

Poor cryptographic salt initialization in admin/inc/templatefunctions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce...

CVE-2017-8081

Poor cryptographic salt initialization in admin/inc/templatefunctions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce...

Cross site request forgery (csrf)

Poor cryptographic salt initialization in admin/inc/templatefunctions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce...

CVE-2017-8081

CVE-2017-8081 affects GetSimple CMS 3.3.13. The issue is a poor cryptographic salt initialization in admin/inc/template_functions.php, which can allow a network attacker to escalate privileges to an arbitrary user or perform CSRF attacks by manipulating session cookies or CSRF nonces. The root ca...

Information Disclosure

salt is vulnerable to an information disclosure vulnerability. The library mirrors the file permissions on the salt-master when setting up its temporary file location for the local cache. This can allow a malicious local user to access sensitive credentials...

Unspecified Vulnerability in SaltStack Salt

SaltStack Salt aka SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions , able to manage tens of thousands of servers , with the ability to quickly complete t...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

PYSEC-2017-82

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions clients...

CVE-2017-8109

Removed by vendor...

CVE-2017-8109

The CVE-2017-8109 entry concerns SaltStack Salt 2016.11 before 2016.11.4, where the salt-ssh minion copied configuration from the Salt Master without adjusting permissions, potentially leaking credentials to local attackers on configured minions. Public writeups in the connected docs confirm the ...

Insecure /Tmp File Handling

Salt handles /tmp files through salt/modules/chef.py insecurely. This may allow attackers to replace the file with a malicious file...

Insecure /tmp File Handling

Salt handles /tmp files through salt/modules/serverdensitydevice.py insecurely. This may allow attackers to replace the file with a malicious file...

Arbitrary Command Execution

Salt is vulnerable to command execution. If the pillar content given to cmd.run is not coming from a trusted source, attackers could execute commands on command line...

Remote Code Execution (RCE)

Salt is vulnerable to remote code execution RCE. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems are enabled...