CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

UBUNTU-CVE-2025-22238

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory...

UBUNTU-CVE-2025-22237

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...

UBUNTU-CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

UBUNTU-CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38824

CVE-2024-38824 is a directory traversal vulnerability in the recv_file method that allows writing arbitrary files into the Salt master cache directory. Public references in multiple advisories (SUSE openSUSE/SUSE-SU-2025-02501/-02492/-02476, SUSE-2025-02492, -02500, -02502) confirm the flaw affec...

CVE-2024-38824 CVE-2024-38824 salt advisory

Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory...

CVE-2024-38824 CVE-2024-38824 salt advisory

Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory...

CVE-2025-22239

CVE-2025-22239 – Salt Master event injection : The Salt Master’s _minion_event method can be abused by an authorized minion to push arbitrary events onto the master's event bus, enabling potential impact on integrity and confidentiality (I, C) with low availability impact. The advisory notes this...

CVE-2025-22239 CVE-2025-22239 salt advisory

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22239 CVE-2025-22239 salt advisory

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22237

CVE-2025-22237 describes an escalation where an attacker with a minion key can abuse Salt’s on-demand pillar via a specially crafted git URL to execute arbitrary commands on the Salt Master with master privileges. The connected Nessus/SUSE advisories state that this issue was mitigated/fixed (as ...

CVE-2025-22237 CVE-2025-22237 salt advisory

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...

CVE-2024-38822

CVE-2024-38822 concerns Salt (Salt Master/Minion interaction): multiple methods in the Salt master skip minion token validation, enabling a misbehaving minion to impersonate another. Evidence from connected advisories shows patches fixing Minion token validation and related Salt issues (e.g., SUS...

[SECURITY] Fedora 41 Update: valkey-8.0.3-3.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from a specially crafted git URL that could trigger the master process to execute arbitrary commands...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...