salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

1 What is it? Scanning tool to test for SaltStack vulnerabilities CVE-2020-11651 & CVE-2020-11652. The vulnerabilities allow an attacker who can connect to the "request server" port to bypass all authentication and authorization controls and publish arbitrary control messages, read and write file...

Exploit for CVE-2020-11651

SaltStack Master Authentication Bypass CVE-2020-11651 Vulh...

The vulnerability of the GCC Conference Create Request server XRDP allows a hacker to disclose sensitive information.

The vulnerability of the GCC Conference Create Request server XRDP lies in the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2005-1572

ShowOff! 1.5.4 allows remote attackers to cause a denial of service server crash via a malformed request to port 8083...

EUVD-2025-122610

Malicious code in request-server-ariel-sirius npm...

EUVD-2024-54684

Malicious code in bioql PyPI...

EUVD-2023-0230

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-38823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. CVE-2024-38823 Note that Nessus relies on the presence of the...

CVE-2025-53531

WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142...

Replay Attack

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

CVE-2024-38823

Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport...

CVE-2024-38823

Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport...

CVE-2024-38823

CVE-2024-38823: Salt’s request server is vulnerable to replay attacks when not using TLS. The initial description confirms the vulnerability and CVSS v3.1 base score of 2.7 (LOW) with network attack vector, requiring high privileges and no user interaction. Connected documents (SUSE advisories) i...

CVE-2024-38823: Authentication Bypass by Capture-replay

Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport...

Combodo iTop 代码问题漏洞

Combodo iTop is a suite of open source web applications developed by French company Combodo based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management and problem management. A code issue vulnerability exists in Combodo iT...

CVE-2023-20897: Improper Resource Shutdown or Release

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted...

Denial Of Service (DoS)

github.com/kubeedge/kubeedge is vulnerable to denial of service DoS attacks. An attacker is able to cause denial of service conditions via memory exhaustion by sending a specifically crafted HTTP request with a large body through the signEdgeCert function in server.go...

CVE-2022-31827

MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery SSRF via the function performFetchRequest at HTTPFetcher.php...

SaltStack Salt Master Server Root Key Disclosure

This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...

Directory Traversal

sprockets is vulnerable to directory traversals. A malicious user can send a http request with the file:// parameter to request and download files from the server...