Salt's worker process vulnerable to denial of service through file read operation

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...

PYSEC-2026-1895 Salt's file contents overwrite the VirtKey class

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location a...

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

Salt vulnerable to directory traversal attack in file receiving method

Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory...

The vulnerability of the configuration management system and remote execution of operations, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of configuration management systems and remote execution of operations like Salt is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

Ubuntu: Security Advisory (USN-8153-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-20260401-73-0045

Vulnerability in salt related to flaws in the authentication procedure. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges...

ROS-20260401-73-0044

Vulnerability in salt related to incorrect code generation control. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2025-62349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using ...

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Salt security vulnerabilities

Salt is an automated, infrastructure management, data-driven orchestration, and remote execution application within the Salt project. There is a security vulnerability in Salt, which stems from the use of insecure YAML decoding/loading in the junos execution module. This may lead to the execution...

AVideo 安全漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. A security vulnerability exists in AVideo versions 14.3.1 through prior to 20.1, which stems from the use of PHP uniqid to generate predictable installation salt values that could lead to remote code...

SUSE-SU-2025:21218-1 Security update for salt

This update for salt fixes the following issues: salt: - Security issues fixed: - CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 - CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 - Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439...

EUVD-2018-17321

Malware in sbrugna...

EUVD-2016-0033

Malware in sbrugna...

EUVD-2025-18254

Malicious code in bioql PyPI...

EUVD-2022-4798

Malicious code in bioql PyPI...

The vulnerability of the configuration management system and the remote execution of operations, Salt, is related to the lack of measures for cleaning input data. This allows attackers to increase their privileges and execute arbitrary commands.

The vulnerability of configuration management systems and remote execution of operations related to Salt is related to the lack of measures for cleaning input data. Exploiting this vulnerability can allow attackers to increase their privileges and execute arbitrary commands...

The vulnerability of the configuration management system and the remote execution of operations, known as Salt, arises from incorrect restrictions on the path to the restricted access catalog. This allows attackers to gain read and modify access to data.

The vulnerability of configuration management systems and remote execution of operations related to Salt is related to incorrect restrictions on the path to the restricted access catalog. Exploiting this vulnerability can allow an attacker to gain read and modify access to data...

Linux Distros Unpatched Vulnerability : CVE-2016-1866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in- the-middle attackers to execute arbitrary code by...